Skip to content

govulncheck: run from a container #1219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xcoulon merged 2 commits into from
Dec 11, 2025
+23 −12
Merged

govulncheck: run from a container #1219

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c756495
govulncheck-action: run from Container image
xcoulon Dec 9, 2025
aca7286
update link to action
xcoulon Dec 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions .github/workflows/govulncheck.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,5 @@ jobs:
- name: Run govulncheck
uses: codeready-toolchain/toolchain-cicd/govulncheck-action@master
with:
go-version-file: go.mod
cache: false
config: .govulncheck.yaml
config: .govulncheck.yaml
debug: true # optional (default = false)
2 changes: 1 addition & 1 deletion .github/workflows/test-with-coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
- name: Install Go
uses: actions/setup-go@v6
with:
go-version file: go.mod
go-version-file: go.mod
Copy link
Contributor

@MatousJobanek MatousJobanek Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice catch 👍

Copy link
Contributor Author

@xcoulon xcoulon Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks ;)


- name: generate
run: |
Expand Down
28 changes: 20 additions & 8 deletions .govulncheck.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,46 +4,58 @@ ignored-vulnerabilities:
# Fixed in: crypto/x509@go1.24.8
- id: GO-2025-4013
info: https://pkg.go.dev/vuln/GO-2025-4013
silence-until: 2025-12-03
silence-until: 2026-01-03
# Lack of limit when parsing cookies can cause memory exhaustion in net/http
# Found in: net/http@go1.23.12
# Fixed in: net/http@go1.24.8
- id: GO-2025-4012
info: https://pkg.go.dev/vuln/GO-2025-4012
silence-until: 2025-12-03
silence-until: 2026-01-03
# Parsing DER payload can cause memory exhaustion in encoding/asn1
# Found in: encoding/asn1@go1.23.12
# Fixed in: encoding/asn1@go1.24.8
- id: GO-2025-4011
info: https://pkg.go.dev/vuln/GO-2025-4011
silence-until: 2025-12-03
silence-until: 2026-01-03
# Insufficient validation of bracketed IPv6 hostnames in net/url
# Found in: net/url@go1.23.12
# Fixed in: net/url@go1.24.8
- id: GO-2025-4010
info: https://pkg.go.dev/vuln/GO-2025-4010
silence-until: 2025-12-03
silence-until: 2026-01-03
# Quadratic complexity when parsing some invalid inputs in encoding/pem
# Found in: encoding/pem@go1.23.12
# Fixed in: encoding/pem@go1.24.8
- id: GO-2025-4009
info: https://pkg.go.dev/vuln/GO-2025-4009
silence-until: 2025-12-03
silence-until: 2026-01-03
# ALPN negotiation error contains attacker controlled information in crypto/tls
# Found in: crypto/tls@go1.23.12
# Fixed in: crypto/tls@go1.24.8
- id: GO-2025-4008
info: https://pkg.go.dev/vuln/GO-2025-4008
silence-until: 2025-12-03
silence-until: 2026-01-03
# Quadratic complexity when checking name constraints in crypto/x509
# Found in: crypto/x509@go1.23.12
# Fixed in: crypto/x509@go1.24.9
- id: GO-2025-4007
info: https://pkg.go.dev/vuln/GO-2025-4007
silence-until: 2025-12-03
silence-until: 2026-01-03
# Excessive CPU consumption in ParseAddress in net/mail
# Found in: net/mail@go1.23.12
# Fixed in: net/mail@go1.24.8
- id: GO-2025-4006
info: https://pkg.go.dev/vuln/GO-2025-4006
silence-until: 2025-12-03
silence-until: 2026-01-03
# Excessive resource consumption when printing error string for host certificate validation in crypto/x509
# Found in: crypto/x509@go1.23.12
# Fixed in: crypto/x509@go1.24.11
- id: GO-2025-4155
info: https://pkg.go.dev/vuln/GO-2025-4155
silence-until: 2026-01-03
Comment on lines +50 to +55
Copy link

@coderabbitai coderabbitai bot Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

GO-2025-4155 golang vulnerability crypto/x509

💡 Result:

Summary: GO-2025-4155 (CVE-2025-61729) is an excessive-resource-consumption bug in crypto/x509: HostnameError.Error() could print an unbounded number of hosts using repeated string concatenation (quadratic runtime), allowing a malicious certificate to cause high CPU/memory use. Fixes limit the number of hosts and use strings.Builder. [1][2]

Affected Go releases:

  • All 1.24.x before 1.24.11; all 1.25.x before 1.25.5. [1]

Fixed in:

  • go1.24.11 and go1.25.5 (upgrade to these or later). [1][2]

References:

  • OSV / GO-2025-4155 (alias CVE-2025-61729). [1]
  • Go issue tracking & description (issue #76445). [2]
  • Fix CL in the Go repo. [3]

If you want, I can provide exact upgrade commands for your platform or scan a go.mod to show whether your codebase is affected.

🏁 Script executed:

# Check if GO-2025-4155 appears elsewhere in the file
rg "GO-2025-4155" .govulncheck.yaml

# Also verify the file structure and list all vulnerability IDs
rg "^\s*- id: GO-" .govulncheck.yaml

Repository: codeready-toolchain/host-operator

Length of output: 210

🏁 Script executed:

# Attempt to read the .govulncheck.yaml file directly without cloning
cat .govulncheck.yaml | rg "GO-2025-4155"

Repository: codeready-toolchain/host-operator

Length of output: 210

🏁 Script executed:

# Try reading the file if it exists in the current context
fd "govulncheck.yaml" --exec cat {}

Repository: codeready-toolchain/host-operator

Length of output: 210

Add go1.25.5 to the fix version for GO-2025-4155.

The vulnerability GO-2025-4155 is published and legitimate (CVE-2025-61729), but the entry is incomplete. The vulnerability is fixed in both go1.24.11 and go1.25.5; the YAML should reflect both versions.

🤖 Prompt for AI Agents 
In .govulncheck.yaml around lines 50 to 55, update the GO-2025-4155 entry so its
"Fixed in" field lists both go1.24.11 and go1.25.5; modify the comment or the
value that currently says "Fixed in: crypto/x509@go1.24.11" to include ",
crypto/x509@go1.25.5" (or add a second "Fixed in" entry if your schema prefers
multiple entries) so the YAML accurately reflects both fix versions for
CVE-2025-61729.

# Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
# Found in: crypto/x509@go1.23.12
# Fixed in: crypto/x509@go1.24.11
- id: GO-2025-4175
info: https://pkg.go.dev/vuln/GO-2025-4175
silence-until: 2026-01-03
Comment on lines +56 to +61
Copy link

@coderabbitai coderabbitai bot Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

GO-2025-4175 Go vulnerability crypto/x509 DNS name constraints

💡 Result:

Summary: GO-2025-4175 (CVE-2025-61727) is a crypto/x509 bug where an excluded DNS name constraint in a certificate chain does not stop a leaf certificate from using a wildcard SAN (e.g., excluding test.example.com doesn’t block a leaf with SAN *.example.com). This can allow acceptance of certificates that should have been excluded. [1][2]

Affected Go versions:

  • All releases before Go 1.24.11 (i.e., < 1.24.11).
  • Go 1.25.0 through < 1.25.5. [1]

Fixes / Mitigation:

  • Upgrade to Go 1.24.11 or Go 1.25.5 (these releases include the fix). [1][3]

References:

  • Go vulnerability entry (GO-2025-4175 / pkg.go.dev). [1]
  • Go issue discussing the bug (Issue #76442). [2]
  • Gerrit CL with the fix. [3]

GO-2025-4175 is a legitimate vulnerability, but the entry is incomplete.

The vulnerability is verified as a real, published Go security issue (CVE-2025-61727) affecting crypto/x509 DNS name constraint validation with wildcard names. However, the entry only documents the fix for Go 1.24.11 and omits that this vulnerability also affects Go 1.25.0–1.25.4 and is fixed in Go 1.25.5. Update the entry to reflect all affected versions and fix versions for completeness.

🤖 Prompt for AI Agents 
.govulncheck.yaml lines 56-61: the GO-2025-4175 entry is incomplete — update its
metadata to list all affected and fixed Go versions. Edit the entry to indicate
the vulnerability affects crypto/x509 in Go 1.23.12 and also Go 1.25.0–1.25.4,
and add the corresponding fix versions Go 1.24.11 and Go 1.25.5 (or merge into a
single affected/fixed field as project conventions require); ensure the info URL
remains and adjust the silence-until date only if policy requires.

Loading