CVE fixes and regular maintenance

pat-s commented

2025-05-02 10:20:34 +00:00

Member

Aiming to make use of the forgejo-runner in a public instance, I'd be happy to see latest release being CVE free.

Running trivy fs . on this repo, I see

go.mod (gomod)

Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 1, CRITICAL: 0)

┌──────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬───────────────────────────────────────────────────────────┐
│             Library              │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version  │                           Title                           │
├──────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼───────────────────────────────────────────────────────────┤
│ github.com/containerd/containerd │ CVE-2024-40635 │ MEDIUM   │ fixed  │ v1.7.13           │ 1.7.27, 1.6.38 │ containerd: containerd has an integer overflow in User ID │
│                                  │                │          │        │                   │                │ handling                                                  │
│                                  │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2024-40635                │
├──────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼───────────────────────────────────────────────────────────┤
│ golang.org/x/crypto              │ CVE-2025-22869 │ HIGH     │        │ v0.31.0           │ 0.35.0         │ golang.org/x/crypto/ssh: Denial of Service in the Key     │
│                                  │                │          │        │                   │                │ Exchange of golang.org/x/crypto/ssh                       │
│                                  │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2025-22869                │
├──────────────────────────────────┼────────────────┼──────────┤        ├───────────────────┼────────────────┼───────────────────────────────────────────────────────────┤
│ golang.org/x/net                 │ CVE-2025-22870 │ MEDIUM   │        │ v0.33.0           │ 0.36.0         │ golang.org/x/net/proxy: golang.org/x/net/http/httpproxy:  │
│                                  │                │          │        │                   │                │ HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net │
│                                  │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2025-22870                │
│                                  ├────────────────┤          │        │                   ├────────────────┼───────────────────────────────────────────────────────────┤
│                                  │ CVE-2025-22872 │          │        │                   │ 0.38.0         │ golang.org/x/net/html: Incorrect Neutralization of Input  │
│                                  │                │          │        │                   │                │ During Web Page Generation in x/net in...                 │
│                                  │                │          │        │                   │                │ https://avd.aquasec.com/nvd/cve-2025-22872

renovate already detects these as pending updates. However, it would be good to get these in and released in regular intervals.

Besides, a "vulnerability dashboard" (inspiration from Crow CI) as a pinned issue would help to see what is currently going on.

Aiming to make use of the `forgejo-runner` in a public instance, I'd be happy to see latest release being CVE free. Running `trivy fs .` on this repo, I see ``` go.mod (gomod) Total: 4 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 1, CRITICAL: 0) ┌──────────────────────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬───────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├──────────────────────────────────┼────────────────┼──────────┼────────┼───────────────────┼────────────────┼───────────────────────────────────────────────────────────┤ │ github.com/containerd/containerd │ CVE-2024-40635 │ MEDIUM │ fixed │ v1.7.13 │ 1.7.27, 1.6.38 │ containerd: containerd has an integer overflow in User ID │ │ │ │ │ │ │ │ handling │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-40635 │ ├──────────────────────────────────┼────────────────┼──────────┤ ├───────────────────┼────────────────┼───────────────────────────────────────────────────────────┤ │ golang.org/x/crypto │ CVE-2025-22869 │ HIGH │ │ v0.31.0 │ 0.35.0 │ golang.org/x/crypto/ssh: Denial of Service in the Key │ │ │ │ │ │ │ │ Exchange of golang.org/x/crypto/ssh │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-22869 │ ├──────────────────────────────────┼────────────────┼──────────┤ ├───────────────────┼────────────────┼───────────────────────────────────────────────────────────┤ │ golang.org/x/net │ CVE-2025-22870 │ MEDIUM │ │ v0.33.0 │ 0.36.0 │ golang.org/x/net/proxy: golang.org/x/net/http/httpproxy: │ │ │ │ │ │ │ │ HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-22870 │ │ ├────────────────┤ │ │ ├────────────────┼───────────────────────────────────────────────────────────┤ │ │ CVE-2025-22872 │ │ │ │ 0.38.0 │ golang.org/x/net/html: Incorrect Neutralization of Input │ │ │ │ │ │ │ │ During Web Page Generation in x/net in... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-22872 ``` `renovate` already detects these as pending updates. However, it would be good to get these in and released in regular intervals. Besides, a "vulnerability dashboard" ([inspiration from Crow CI](https://codeberg.org/crowci/crow/issues/20)) as a pinned issue would help to see what is currently going on.

earl-warren commented

2025-05-02 12:36:50 +00:00

Contributor

Agreed. The renovate dashboards:

are meant to propose updates when a direct dependency has a CVE that needs fixing. In this case it looks like none of them are. Which does not mean they don't deserve upgrading 😁

@viceice do you have an opinion?

Agreed. The renovate dashboards: - https://code.forgejo.org/forgejo/act/issues/47 - https://code.forgejo.org/forgejo/runner/issues/236 are meant to propose updates when a direct dependency has a CVE that needs fixing. In this case it looks like none of them are. Which does not mean they don't deserve upgrading 😁 @viceice do you have an opinion?

viceice commented

2025-05-02 13:46:12 +00:00

Owner

For such cases we usally activate lockfile maintenance, which would update all transitive deps to latest versions. We do it on forgejo.

viceice commented

2025-05-02 13:50:08 +00:00

Owner

Checking why this doesn't work for go

":maintainLockFilesWeekly",

Ah renovate by default doesn't propose updates to indirect deps. We can enable it.

Checking why this doesn't work for go https://code.forgejo.org/forgejo/renovate-config/src/commit/15e2ce679099ad7da2f90b589fcb7b8d1def5015/default.json#L7 Ah renovate by default doesn't propose updates to indirect deps. We can enable it.

viceice commented

2025-05-02 13:51:41 +00:00

Owner

golang.org/x/crypto v0.31.0 // indirect

indirect

https://code.forgejo.org/forgejo/act/src/commit/af28212d7052afec0bf70d3c84da54c3fcebb4e9/go.mod#L95 indirect

viceice commented

2025-05-02 13:52:41 +00:00

Owner

https://docs.renovatebot.com/modules/manager/gomod/

https://docs.renovatebot.com/modules/manager/gomod/ ![image](/attachments/43b39d1e-5c44-46a1-bca5-2d6506c25d86)

image.png

27 KiB

👍 1

earl-warren commented

2025-05-02 16:19:15 +00:00

Contributor

That's worth a try. There are ~60 of them, it is not overwhelming.

pat-s commented

2025-05-11 16:54:07 +00:00

Author

Member

@earl-warren @viceice Is there any way I could help with reviewing/merging pending PRs?

viceice commented

2025-05-11 17:07:29 +00:00

Owner

sure, feel free to review open PRs

pat-s commented

2025-05-11 17:10:40 +00:00

Author

Member

I meant to merge/review the pending sec PRs and eventually issue new releases. (Auto-merge is disabled for these in this repo.)

viceice commented

2025-05-11 17:33:33 +00:00

Owner

we need to check the renovate logs why those security fixes are not opened automatically. they are internally forced normally

viceice commented

2025-05-12 08:30:33 +00:00

Owner

Ok, it seems security updates can't override the disabled state. 🤔

               {
                 "currentValue": "v0.31.0",
                 "datasource": "go",
                 "depName": "golang.org/x/crypto",
                 "depType": "indirect",
                 "enabled": false,
                 "managerData": {"lineNumber": 94, "multiLine": true},
                 "packageName": "golang.org/x/crypto",
                 "skipReason": "disabled",
                 "updates": []
               },

Ok, it seems security updates can't override the disabled state. 🤔 ```json { "currentValue": "v0.31.0", "datasource": "go", "depName": "golang.org/x/crypto", "depType": "indirect", "enabled": false, "managerData": {"lineNumber": 94, "multiLine": true}, "packageName": "golang.org/x/crypto", "skipReason": "disabled", "updates": [] }, ```

viceice commented

2025-05-12 08:40:19 +00:00

Owner

let's see if this works

forgejo/renovate-config@4bff6dc36a

https://docs.renovatebot.com/modules/manager/gomod/

let's see if this works https://code.forgejo.org/forgejo/renovate-config/commit/4bff6dc36a286755b68eb720b14db21c33267ba1 https://docs.renovatebot.com/modules/manager/gomod/

viceice commented

2025-06-30 14:23:21 +00:00

Owner

i think this can now be closed?

👍 1

pat-s commented

2025-06-30 17:00:20 +00:00

Author

Member

Thanks for releasing an update.

My hopes are rather long-term, i.e. regular merges of important deps and (optionally) regular checks for CVEs using trivy or another related CVE scanning tool. The dependency dashboard list in this repo is also quite large and I think there's still room for improvement ;) But I'll close here for now and hope this is addressed or will be in the future without bringing this up again.

Thanks for releasing an update. My hopes are rather long-term, i.e. regular merges of important deps and (optionally) regular checks for CVEs using `trivy` or another related CVE scanning tool. The dependency dashboard list in this repo is also quite large and I think there's still room for improvement ;) But I'll close here for now and hope this is addressed or will be in the future without bringing this up again.

pat-s closed this issue

2025-06-30 17:00:20 +00:00

Rows
Columns

CVE fixes and regular maintenance #552