From 0a482377ea5ceb144eb634e555fb3bf914f59f24 Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Thu, 22 Oct 2026 09:38:17 +0200 Subject: [PATCH] Bump Alpine to 3.24.3, Go to 1.26.10 and x/net to 0.61.0 Alpine 3.24.3 fixes musl's CVE-2026-107891, and drops the infamous eMudhra CAs with their ridiculous private keys. Go 1.26.10 rejects certificate chains containing any of the eight compromised eMudhra keys (CVE-2026-111943). The golang.org/x/net bump to 0.61.0 fixes CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669 and CVE-2026-97032, which Trivy flags in the dhcp plugin. Signed-off-by: Tom Wieczorek --- Dockerfile | 10 +- ...003-Bump-golang.org-x-net-to-v0.61.0.patch | 112 ++++++++++++++++++ 2 files changed, 116 insertions(+), 6 deletions(-) create mode 100644 files/patches/0003-Bump-golang.org-x-net-to-v0.61.0.patch diff --git a/Dockerfile b/Dockerfile index 1160043..528995b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ ARG \ - ALPINE_IMAGE=docker.io/library/alpine:3.24.1 \ - GOLANG_IMAGE=docker.io/library/golang:1.26.5-alpine3.24 \ + ALPINE_IMAGE=docker.io/library/alpine:3.24.3 \ + GOLANG_IMAGE=docker.io/library/golang:1.26.10-alpine3.24 \ VERSION=1.9.1 \ HASH=34bd82d47e981940751619c9cc44c095bb90bfcaf8d71865cbb822c37690a764 @@ -20,10 +20,8 @@ RUN --mount=source=files/patches,target=/run/patches,ro \ patch -p1 <"$p"; \ done -# Patch some deps to silence CVE scanners -RUN go mod edit -replace golang.org/x/net=golang.org/x/net@v0.57.0 \ - && go mod tidy \ - && go mod vendor +# Re-vendor the dependencies, as the patches may have touched go.mod/go.sum +RUN go mod vendor FROM sources AS bins diff --git a/files/patches/0003-Bump-golang.org-x-net-to-v0.61.0.patch b/files/patches/0003-Bump-golang.org-x-net-to-v0.61.0.patch new file mode 100644 index 0000000..d490fb1 --- /dev/null +++ b/files/patches/0003-Bump-golang.org-x-net-to-v0.61.0.patch @@ -0,0 +1,112 @@ +From 68a1e2e1f53412b54ac668a6773fb39003af643a Mon Sep 17 00:00:00 2001 +From: Tom Wieczorek +Date: Thu, 22 Oct 2026 09:28:40 +0200 +Subject: [PATCH 1/1] Bump golang.org/x/net to v0.61.0 + +Fixes CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669 +and CVE-2026-97032 in golang.org/x/net/http2, which are flagged by CVE +scanners in the dhcp plugin. + +Pulls in the newer golang.org/x/{sync,sys,text,tools} modules that x/net +v0.61.0 requires, and bumps the go directive to 1.26.0 accordingly. + +Signed-off-by: Tom Wieczorek +--- + go.mod | 12 ++++++------ + go.sum | 20 ++++++++++---------- + 2 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/go.mod b/go.mod +index 513e7c8..0e25794 100644 +--- a/go.mod ++++ b/go.mod +@@ -1,6 +1,6 @@ + module github.com/containernetworking/plugins + +-go 1.24.2 ++go 1.26.0 + + require ( + github.com/Microsoft/hcsshim v0.13.0 +@@ -20,7 +20,7 @@ require ( + github.com/safchain/ethtool v0.6.2 + github.com/vishvananda/netlink v1.3.1 + github.com/vishvananda/netns v0.0.5 +- golang.org/x/sys v0.35.0 ++ golang.org/x/sys v0.49.0 + sigs.k8s.io/knftables v0.0.18 + ) + +@@ -48,10 +48,10 @@ require ( + go.opencensus.io v0.24.0 // indirect + go.uber.org/automaxprocs v1.6.0 // indirect + go.yaml.in/yaml/v3 v3.0.4 // indirect +- golang.org/x/net v0.43.0 // indirect +- golang.org/x/sync v0.16.0 // indirect +- golang.org/x/text v0.28.0 // indirect +- golang.org/x/tools v0.36.0 // indirect ++ golang.org/x/net v0.61.0 // indirect ++ golang.org/x/sync v0.24.0 // indirect ++ golang.org/x/text v0.43.0 // indirect ++ golang.org/x/tools v0.51.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 // indirect + google.golang.org/grpc v1.69.0 // indirect + google.golang.org/protobuf v1.36.7 // indirect +diff --git a/go.sum b/go.sum +index 708fef9..866acd8 100644 +--- a/go.sum ++++ b/go.sum +@@ -160,8 +160,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL + golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= + golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= + golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= +-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE= +-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg= ++golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= ++golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= + golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= + golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +@@ -169,8 +169,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ + golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw= +-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= ++golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= ++golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= + golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +@@ -182,13 +182,13 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc + golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= + golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= + golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI= +-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= ++golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= ++golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= + golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= + golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng= +-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU= ++golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= ++golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= + golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= + golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= + golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= +@@ -198,8 +198,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn + golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= + golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= + golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= +-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg= +-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s= ++golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= ++golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= + golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= + golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= + golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +-- +2.54.0 +