Skip to content

Commit

Permalink
Fix satori/go.uuid security vulnerability (#18)
Browse files Browse the repository at this point in the history
Signed-off-by: 1gtm <1gtm@appscode.com>
  • Loading branch information
1gtm committed Oct 25, 2021
1 parent 21c7845 commit f792df1
Show file tree
Hide file tree
Showing 7 changed files with 58 additions and 30 deletions.
5 changes: 2 additions & 3 deletions go.mod
Expand Up @@ -13,7 +13,6 @@ require (
github.com/pkg/errors v0.9.1
github.com/soheilhy/cmux v0.1.5 // indirect
github.com/stretchr/testify v1.7.0
golang.org/x/crypto v0.0.0-20210314154223-e6e6c4f2bb5b // indirect
golang.org/x/oauth2 v0.0.0-20210615190721-d04028783cf1 // indirect
gomodules.xyz/runtime v0.2.0
google.golang.org/genproto v0.0.0-20210617175327-b9e0b3197ced // indirect
Expand All @@ -24,7 +23,7 @@ require (
k8s.io/client-go v0.21.2
k8s.io/klog/v2 v2.8.0
k8s.io/kube-openapi v0.0.0-20210305001622-591a79e4bda7
kmodules.xyz/client-go v0.0.0-20210928133955-8df5bb467db6
kmodules.xyz/client-go v0.0.0-20211023080224-88313b8deed7
kmodules.xyz/crd-schema-fuzz v0.0.0-20210618002152-fae23aef5fb4
kmodules.xyz/monitoring-agent-api v0.0.0-20210928135619-38ca075a2dbd
kmodules.xyz/webhook-runtime v0.0.0-20210928141616-7f73c2ab318a
Expand Down Expand Up @@ -136,7 +135,7 @@ replace k8s.io/utils => k8s.io/utils v0.0.0-20201110183641-67b214c5f920

replace sigs.k8s.io/application => github.com/kmodules/application v0.8.4-0.20210427030912-90eeee3bc4ad

replace github.com/satori/go.uuid => github.com/gofrs/uuid v4.0.0+incompatible
replace github.com/satori/go.uuid => github.com/gomodules/uuid v4.0.0+incompatible

replace github.com/dgrijalva/jwt-go => github.com/gomodules/jwt v3.2.2+incompatible

Expand Down
10 changes: 7 additions & 3 deletions go.sum
Expand Up @@ -225,9 +225,9 @@ github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/me
github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
github.com/gobuffalo/here v0.6.0/go.mod h1:wAG085dHOYqUpf+Ap+WOdrPTp5IYcDAs/x7PLa8Y5fM=
github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
github.com/golang/glog v0.0.0-20210429001901-424d2337a529 h1:2voWjNECnrZRbfwXxHB1/j8wa6xdKn85B5NzgVL/pTU=
Expand All @@ -247,6 +247,7 @@ github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8l
github.com/golangplus/testing v0.0.0-20180327235837-af21d9c3145e/go.mod h1:0AA//k/eakGydO4jKRoRL2j92ZKSzTgj9tclaCrvXHk=
github.com/gomodules/jwt v3.2.2+incompatible h1:tEQKHcGKfDKsHLf5VmQvKf3YTmQPNt9GP5b4YF2jyDs=
github.com/gomodules/jwt v3.2.2+incompatible/go.mod h1:cOm5eKP+RVgQveNVZfQ7ZEc5KPmk2F2i/JNDKlkzzDQ=
github.com/gomodules/uuid v4.0.0+incompatible/go.mod h1:y+m9jPMEPSC/06TKQU/pMb7c5qNUHtEvfjPt8yNA8p0=
github.com/gomodules/validate v0.19.8-1.16/go.mod h1:8DJv2CVJQ6kGNpFW6eV9N3JviE1C85nY1c2z52x1Gk4=
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
github.com/google/btree v1.0.0 h1:0udJVsspx3VBr5FwtLhQQtuAsVc79tTq0ocGIPAU6qo=
Expand Down Expand Up @@ -882,6 +883,7 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
gomodules.xyz/homedir v0.0.0-20201104190528-bcd4d5d94b84/go.mod h1:rNt5O0KsgdJjAD/UXuxhO2N3b5TegqEk1T8HG9eraH4=
gomodules.xyz/homedir v0.1.0/go.mod h1:rNt5O0KsgdJjAD/UXuxhO2N3b5TegqEk1T8HG9eraH4=
gomodules.xyz/jsonpatch/v2 v2.2.0 h1:4pT439QV83L+G9FkcCriY6EkpcK6r6bK+A5FBUMI7qY=
gomodules.xyz/jsonpatch/v2 v2.2.0/go.mod h1:WXp+iVDkoLQqPudfQ9GBlwB2eZ5DKOnjQZCYdOS8GPY=
gomodules.xyz/mergo v0.3.13-0.20210702100041-9d62ff8ece4d h1:i6r7bk2jF965W3xmORgz+KYhlH608oRvrAPpcNHorlo=
Expand All @@ -896,8 +898,10 @@ gomodules.xyz/runtime v0.2.0 h1:fzoGf/lnQ2F/rakbCjNfrZZFiNQ8XVLrR5YrtuhrtkU=
gomodules.xyz/runtime v0.2.0/go.mod h1:/R/Dw906YIUHKJ5cfKUaJgJrojFjpRU+n0s3Wjn1tqs=
gomodules.xyz/sets v0.0.0-20200930152147-4f4543544799/go.mod h1:jKgNp01/iDs+svOWXaPk5cKP3VXy0mWUoTF/ore+aMc=
gomodules.xyz/sets v0.1.0/go.mod h1:jKgNp01/iDs+svOWXaPk5cKP3VXy0mWUoTF/ore+aMc=
gomodules.xyz/sets v0.2.0/go.mod h1:jKgNp01/iDs+svOWXaPk5cKP3VXy0mWUoTF/ore+aMc=
gomodules.xyz/x v0.0.5/go.mod h1:EGy7cB7ifSuOcbNFc0U1zUPTf5yY8RtXVJlAlhGS9OE=
gomodules.xyz/x v0.0.7/go.mod h1:CMXe28rpApV30pPw9cxdyEmvoC+aa5LiAqzks9dlxag=
gomodules.xyz/x v0.0.8/go.mod h1:YnL5CAnLrEtAV/NQGn5sKJe6u08/vDlRyJddXIuD9mc=
gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485/go.mod h1:2ltnJ7xHfj0zHS40VVPYEAAMTa3ZGguvHGBSJeRWqE0=
gonum.org/v1/gonum v0.6.2/go.mod h1:9mxDZsDKxgMAuccQkewq682L+0eCu4dCN2yonUJTCLU=
Expand Down Expand Up @@ -1011,8 +1015,8 @@ k8s.io/utils v0.0.0-20201110183641-67b214c5f920 h1:CbnUZsM497iRC5QMVkHwyl8s2tB3g
k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
kmodules.xyz/client-go v0.0.0-20210617233340-13d22e91512b/go.mod h1:A6GAK6xP5zBuWK6A/vUkkjKzcuywkms7fIxRf5wblO4=
kmodules.xyz/client-go v0.0.0-20210831030638-b1d662179991/go.mod h1:0gkPeALtYjB27OHt4rd6+ZmMgoVTHVLtEJQeU23/gtA=
kmodules.xyz/client-go v0.0.0-20210928133955-8df5bb467db6 h1:o+SymmN26C8bqh1nLTFjT0UdOtAYrTLbp6v49iRe5MY=
kmodules.xyz/client-go v0.0.0-20210928133955-8df5bb467db6/go.mod h1:0gkPeALtYjB27OHt4rd6+ZmMgoVTHVLtEJQeU23/gtA=
kmodules.xyz/client-go v0.0.0-20211023080224-88313b8deed7 h1:jQyhUneTBEM2HAyfOKEXwffh480SJKAVWTalt7jT3qk=
kmodules.xyz/client-go v0.0.0-20211023080224-88313b8deed7/go.mod h1:AlUwXRfFLP1Rfp1lrx6iJ6R+ArWHMAXnYjfF3YndArQ=
kmodules.xyz/crd-schema-fuzz v0.0.0-20210618002152-fae23aef5fb4 h1:vg6VZCnkHu3kJKdUe/oswi7MhjUVcZpyP/aXYhKFZ7M=
kmodules.xyz/crd-schema-fuzz v0.0.0-20210618002152-fae23aef5fb4/go.mod h1:IIkUctlfoptoci0BOrsUf8ya+MOG5uaeh1PE4uzaIbA=
kmodules.xyz/monitoring-agent-api v0.0.0-20210928135619-38ca075a2dbd h1:G1HkRXnQx2H63HFRrY+4oWPJg78W2RnzepJqjm8KT/M=
Expand Down
9 changes: 9 additions & 0 deletions vendor/kmodules.xyz/client-go/core/v1/kubernetes.go
Expand Up @@ -108,6 +108,15 @@ func UpsertContainers(containers []core.Container, addons []core.Container) []co
return out
}

func DeleteContainer(containers []core.Container, name string) []core.Container {
for i, v := range containers {
if v.Name == name {
return append(containers[:i], containers[i+1:]...)
}
}
return containers
}

func UpsertVolume(volumes []core.Volume, nv ...core.Volume) []core.Volume {
upsert := func(v core.Volume) {
for i, vol := range volumes {
Expand Down
20 changes: 15 additions & 5 deletions vendor/kmodules.xyz/client-go/go.mod
Expand Up @@ -12,11 +12,12 @@ require (
github.com/gabriel-vasile/mimetype v1.2.0
github.com/go-openapi/spec v0.19.5
github.com/gogo/protobuf v1.3.2
github.com/google/go-cmp v0.5.4
github.com/golang-jwt/jwt v0.0.0-00010101000000-000000000000 // indirect
github.com/google/go-cmp v0.5.6
github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7
github.com/imdario/mergo v0.3.12
github.com/jpillora/go-ogle-analytics v0.0.0-20161213085824-14b04e0594ef
github.com/json-iterator/go v1.1.10
github.com/json-iterator/go v1.1.11
github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88 // indirect
github.com/mitchellh/mapstructure v1.1.2
github.com/pkg/errors v0.9.1
Expand All @@ -26,10 +27,11 @@ require (
github.com/yudai/gojsondiff v1.0.0
github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 // indirect
github.com/yudai/pp v2.0.1+incompatible // indirect
golang.org/x/crypto v0.0.0-20210314154223-e6e6c4f2bb5b // indirect
gomodules.xyz/jsonpatch/v2 v2.2.0
gomodules.xyz/mergo v0.3.13-0.20210702100041-9d62ff8ece4d
gomodules.xyz/pointer v0.1.0
gomodules.xyz/x v0.0.7
gomodules.xyz/x v0.0.8
k8s.io/api v0.21.1
k8s.io/apiextensions-apiserver v0.21.1
k8s.io/apimachinery v0.21.1
Expand Down Expand Up @@ -125,13 +127,13 @@ replace google.golang.org/genproto => google.golang.org/genproto v0.0.0-20201110

replace google.golang.org/grpc => google.golang.org/grpc v1.27.1

replace helm.sh/helm/v3 => github.com/kubepack/helm/v3 v3.1.0-rc.1.0.20210503022716-7e2d4913a125
replace helm.sh/helm/v3 => github.com/kubepack/helm/v3 v3.6.1-0.20210518225915-c3e0ce48dd1b

replace k8s.io/api => k8s.io/api v0.21.1

replace k8s.io/apimachinery => github.com/kmodules/apimachinery v0.21.2-rc.0.0.20210617231004-332981b97d2d

replace k8s.io/apiserver => github.com/kmodules/apiserver v0.21.2-0.20210617231348-daadbf0c8d5e
replace k8s.io/apiserver => github.com/kmodules/apiserver v0.21.2-0.20210716212718-83e5493ac170

replace k8s.io/cli-runtime => k8s.io/cli-runtime v0.21.1

Expand All @@ -146,3 +148,11 @@ replace k8s.io/kubernetes => github.com/kmodules/kubernetes v1.22.0-alpha.0.0.20
replace k8s.io/utils => k8s.io/utils v0.0.0-20201110183641-67b214c5f920

replace sigs.k8s.io/application => github.com/kmodules/application v0.8.4-0.20210427030912-90eeee3bc4ad

replace github.com/satori/go.uuid => github.com/gofrs/uuid v4.0.0+incompatible

replace github.com/dgrijalva/jwt-go => github.com/gomodules/jwt v3.2.2+incompatible

replace github.com/golang-jwt/jwt => github.com/golang-jwt/jwt v3.2.2+incompatible

replace github.com/form3tech-oss/jwt-go => github.com/form3tech-oss/jwt-go v3.2.5+incompatible

0 comments on commit f792df1

Please sign in to comment.