Skip to content

[Project Darkstar] ROSAENG-63316: Remediate 2 Go stdlib CVEs in aws-vpce-operator - #465

Draft
kseiter-rh wants to merge 1 commit into
openshift:mainfrom
kseiter-rh:cve-fix/aws-vpce-operator-darkstar-2026-08-06
Draft

[Project Darkstar] ROSAENG-63316: Remediate 2 Go stdlib CVEs in aws-vpce-operator#465
kseiter-rh wants to merge 1 commit into
openshift:mainfrom
kseiter-rh:cve-fix/aws-vpce-operator-darkstar-2026-08-06

Conversation

@kseiter-rh

@kseiter-rh kseiter-rh commented Aug 6, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown

[Project Darkstar] ROSAENG-63316: Remediate CVEs in aws-vpce-operator

Changes

  • Add toolchain go1.25.12 to go.mod (fixes Go stdlib CVEs)

Fixed — Go stdlib (2 CVEs)

Already Fixed (4 CVEs)

Covered by existing open PRs — merge to resolve:

No Fix Available

  • 14 RPM-level CVEs (curl-minimal, glib2, libarchive, libxml2) — no upstream fix

FedRAMP SLA: Critical/Important CVEs must be remediated within 30 days of detection.

About Project Darkstar

Summary by CodeRabbit

  • Chores
    • Updated the required Go toolchain version to 1.25.12.

@kseiter-rh
fix(security): [Project Darkstar] remediate Go stdlib CVEs — add tool…
b127233 
…chain go1.25.12

Addresses CVE-2026-39822 (CVSS 7.5) and CVE-2026-42505 (CVSS 5.3).
Adds Go toolchain directive go1.25.12 to go.mod.

Ref: ROSAENG-63316
Project Darkstar — automated CVE remediation (contact: Kevin Seiter)
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 6, 2026
@openshift-ci-robot

openshift-ci-robot commented Aug 6, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@kseiter-rh: This pull request references ROSAENG-63316 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set.

Details

In response to this:

[Project Darkstar] ROSAENG-63316: Remediate CVEs in aws-vpce-operator

Changes

  • Add toolchain go1.25.12 to go.mod (fixes Go stdlib CVEs)

Fixed — Go stdlib (2 CVEs)

  • CVE-2026-39822 (stdlib, CVSS 7.5) — fix: Go 1.25.12+
  • CVE-2026-42505 (stdlib, CVSS 5.3) — fix: Go 1.25.12+

Already Fixed (4 CVEs)

Covered by existing open PRs — merge to resolve:

No Fix Available

  • 14 RPM-level CVEs (curl-minimal, glib2, libarchive, libxml2) — no upstream fix

FedRAMP SLA: Critical/Important CVEs must be remediated within 30 days of detection.

About Project Darkstar

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 6, 2026
@openshift-ci

openshift-ci Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@coderabbitai

coderabbitai Bot commented Aug 6, 2026 •
edited
Loading

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 268103bd-7428-4e7d-b208-97ab03789956

📥 Commits

Reviewing files that changed from the base of the PR and between 6af00e6 and b127233.

📒 Files selected for processing (1)
  • go.mod

Walkthrough

The module configuration now requires Go toolchain version 1.25.12.

Changes

Go toolchain configuration

Layer / File(s) Summary
Set required Go toolchain
go.mod		 Adds the go1.25.12 toolchain requirement to the module configuration.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name Status Explanation Resolution
Ote Binary Stdout Contract ❌ Error With fips_enabled, fips.go:init calls fmt.Println and writes a non-JSON message to stdout from process-level code. Write the FIPS status message to os.Stderr or remove the message so process stdout remains reserved for JSON.
✅ Passed checks (14 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the security remediation and affected project, matching the Go toolchain update described in the pull request.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The pull request changes only go.mod; it adds no Ginkgo test titles and modifies no test files.
Test Structure And Quality ✅ Passed The commit changes only go.mod by adding toolchain go1.25.12; it adds no Ginkgo It blocks, setup, cleanup, waits, or assertions to review.
Microshift Test Compatibility ✅ Passed The PR changes only go.mod; it adds no Ginkgo e2e tests or test constructs, so MicroShift test compatibility does not apply.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The pull request changes only go.mod; it adds no new Ginkgo e2e tests or multi-node assumptions.
Topology-Aware Scheduling Compatibility ✅ Passed The PR changes only go.mod by adding toolchain go1.25.12; it adds or modifies no deployment manifest, operator code, controller, or scheduling constraint.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed HEAD changes only go.mod, adding toolchain go1.25.12; no new Ginkgo e2e tests or network behavior were added.
No-Weak-Crypto ✅ Passed The commit changes only go.mod by adding toolchain go1.25.12; repository searches found no weak crypto APIs, custom crypto, or secret/token comparisons in production Go code.
Container-Privileges ✅ Passed The PR changes only go.mod and adds no container or Kubernetes manifest settings; no privileged, host namespace, SYS_ADMIN, or root execution setting is introduced.
No-Sensitive-Data-In-Logs ✅ Passed The patch changes only go.mod by adding toolchain go1.25.12; added content contains no logging APIs or sensitive-data terms.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@openshift-ci

openshift-ci Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: kseiter-rh
Once this PR has been reviewed and has the lgtm label, please assign bmeng for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@kseiter-rh @openshift-ci-robot