Skip to content

chore(core): mitigate CVEs based on report 2026-06-29#2557

Merged
diafour merged 4 commits into
mainfrom
chore/core/cve-migitation-2026-06-29
Jul 6, 2026
Merged

chore(core): mitigate CVEs based on report 2026-06-29#2557
diafour merged 4 commits into
mainfrom
chore/core/cve-migitation-2026-06-29

Conversation

@diafour

@diafour diafour commented Jun 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Description

Mitigate Trivy-reported High/Critical vulnerabilities in dependencies.

Updated CVE-related replacements:

  • golang.org/x/crypto -> v0.52.0
  • golang.org/x/net -> v0.55.0
  • golang.org/x/oauth2 -> v0.34.0
  • golang.org/x/sys -> v0.45.0

See also support PRs:

Backports:

Why do we need it, and what problem does it solve?

Mitigate CVE list:

CVE-2026-25680
CVE-2026-25681
CVE-2026-27136
CVE-2026-33814
CVE-2026-39821
CVE-2026-39827
CVE-2026-39828
CVE-2026-39829
CVE-2026-39830
CVE-2026-39832
CVE-2026-39835
CVE-2026-42502
CVE-2026-42506
CVE-2026-42508
CVE-2026-46595
CVE-2026-46597

Add CVE-2026-41579 justification in VEX format for for github.com/opencontainers/runc dependency.

What is the expected result?

No Critical and High severity CVEs in the Trivy report.

Checklist

  • The code is covered by unit tests.
  • e2e tests passed.
  • Documentation updated according to the changes.
  • Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: core
type: chore
summary: |
  Fixed vulnerabilities:
  - CVE-2026-25680
  - CVE-2026-25681
  - CVE-2026-27136
  - CVE-2026-33814
  - CVE-2026-39821
  - CVE-2026-39827
  - CVE-2026-39828
  - CVE-2026-39829
  - CVE-2026-39830
  - CVE-2026-39832
  - CVE-2026-39835
  - CVE-2026-41579
  - CVE-2026-42502
  - CVE-2026-42506
  - CVE-2026-42508
  - CVE-2026-46595
  - CVE-2026-46597

@diafour diafour force-pushed the chore/core/cve-migitation-2026-06-29 branch from 4413ea4 to 517ae09 Compare June 30, 2026 14:24
@diafour diafour added this to the v1.10.0 milestone Jun 30, 2026
@diafour diafour force-pushed the chore/core/cve-migitation-2026-06-29 branch 3 times, most recently from 4d8e036 to 944c100 Compare July 2, 2026 12:43
@diafour diafour requested a review from LopatinDmitr July 2, 2026 15:21
@diafour diafour marked this pull request as ready for review July 2, 2026 15:27
LopatinDmitr
LopatinDmitr reviewed Jul 3, 2026
View reviewed changes
Comment thread images/virt-artifact/werf.inc.yaml Outdated
LopatinDmitr
LopatinDmitr reviewed Jul 3, 2026
View reviewed changes
Comment thread images/virt-handler/known_vulnerabilities.vex
LopatinDmitr
LopatinDmitr reviewed Jul 3, 2026
View reviewed changes
Comment thread images/virt-launcher/known_vulnerabilities.vex
LopatinDmitr
LopatinDmitr previously approved these changes Jul 3, 2026
View reviewed changes
diafour added a commit to deckhouse/3p-containerized-data-importer that referenced this pull request Jul 6, 2026
@diafour
fix: mitigate CVEs based on report 2026-06-29 (#37)
6db791a 
Updated CVE-related replacements
- golang.org/x/crypto -> v0.52.0
- golang.org/x/net -> v0.55.0
- golang.org/x/oauth2 -> v0.34.0

See deckhouse/virtualization#2557
diafour added a commit to deckhouse/3p-kubevirt that referenced this pull request Jul 6, 2026
@diafour
fix: mitigate CVEs based on report 2026-06-29 (#136)
241de8c 
* fix: mitigate CVEs based on report 2026-06-29

Updated CVE-related replacements
- golang.org/x/crypto -> v0.52.0
- golang.org/x/net -> v0.55.0
- golang.org/x/oauth2 -> v0.34.0
- Go 1.24 -> Go 1.25

See deckhouse/virtualization#2557

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
diafour and others added 4 commits July 6, 2026 13:55
@diafour
chore(core): mitigate CVEs based on report 2026-06-29
ca42862 
- Mitigate Trivy-reported High/Critical vulnerabilities in dependencies.

Updated CVE-related replacements:
golang.org/x/crypto -> v0.52.0
golang.org/x/net -> v0.55.0
golang.org/x/oauth2 -> v0.34.0

- Add CVE-2026-41579 justification in VEX format for for github.com/opencontainers/runc dependency.

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
@diafour
++ skip cyrillic validation in VEX files
969c77b 
Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
@himax1991 @diafour
add vex template include
c1023bd 
Signed-off-by: Maksim Khimchenko <maksim.khimchenko@flant.com>
@diafour
++ set tags for 3p-kubevirt, 3p-cdi
8bf68ed 
Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
@diafour diafour force-pushed the chore/core/cve-migitation-2026-06-29 branch from c5c69bd to 8bf68ed Compare July 6, 2026 10:56
@LopatinDmitr LopatinDmitr self-requested a review July 6, 2026 11:07
This was referenced Jul 6, 2026
Merged
Merged
@diafour diafour merged commit ab74177 into main Jul 6, 2026
33 of 34 checks passed
@diafour diafour deleted the chore/core/cve-migitation-2026-06-29 branch July 6, 2026 11:23
@deckhouse-BOaTswain deckhouse-BOaTswain mentioned this pull request Jul 6, 2026
Open
diafour added a commit to deckhouse/3p-kubevirt that referenced this pull request Jul 6, 2026
@diafour
backport: fix: mitigate CVEs based on report 2026-06-29 (#136)
0dd6bb2 
Backport for release 1.9.

* fix: mitigate CVEs based on report 2026-06-29

Updated CVE-related replacements
- golang.org/x/crypto -> v0.52.0
- golang.org/x/net -> v0.55.0
- golang.org/x/oauth2 -> v0.34.0
- Go 1.24 -> Go 1.25

See deckhouse/virtualization#2557

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
This was referenced Jul 6, 2026
Merged
Merged
diafour added a commit that referenced this pull request Jul 8, 2026
@diafour
chore(core): mitigate CVEs based on report 2026-06-29 (#2557)
54dc004 
* chore(core): mitigate CVEs based on report 2026-06-29

- Mitigate Trivy-reported High/Critical vulnerabilities in dependencies.

Updated CVE-related replacements:
golang.org/x/crypto -> v0.52.0
golang.org/x/net -> v0.55.0
golang.org/x/oauth2 -> v0.34.0

- Fixed vulnerabilities:
  - CVE-2026-25680
  - CVE-2026-25681
  - CVE-2026-27136
  - CVE-2026-33814
  - CVE-2026-39821
  - CVE-2026-39827
  - CVE-2026-39828
  - CVE-2026-39829
  - CVE-2026-39830
  - CVE-2026-39832
  - CVE-2026-39835
  - CVE-2026-42502
  - CVE-2026-42506
  - CVE-2026-42508
  - CVE-2026-46595
  - CVE-2026-46597
  - CVE-2026-53935

- Add CVE-2026-41579 justification in VEX format for for github.com/opencontainers/runc dependency.

- Skip cyrillic validation in VEX files

---------

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
Signed-off-by: Maksim Khimchenko <maksim.khimchenko@flant.com>
Co-authored-by: Maksim Khimchenko <maksim.khimchenko@flant.com>

(cherry picked from commit ab74177)
Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
diafour added a commit that referenced this pull request Jul 8, 2026
@diafour
chore(core): mitigate CVEs based on report 2026-06-29 (#2557)
9709dee 
* chore(core): mitigate CVEs based on report 2026-06-29

- Mitigate Trivy-reported High/Critical vulnerabilities in dependencies.

Updated CVE-related replacements:
golang.org/x/crypto -> v0.52.0
golang.org/x/net -> v0.55.0
golang.org/x/oauth2 -> v0.34.0

- Fixed vulnerabilities:
  - CVE-2026-25680
  - CVE-2026-25681
  - CVE-2026-27136
  - CVE-2026-33814
  - CVE-2026-39821
  - CVE-2026-39827
  - CVE-2026-39828
  - CVE-2026-39829
  - CVE-2026-39830
  - CVE-2026-39832
  - CVE-2026-39835
  - CVE-2026-42502
  - CVE-2026-42506
  - CVE-2026-42508
  - CVE-2026-46595
  - CVE-2026-46597
  - CVE-2026-53935

- Add CVE-2026-41579 justification in VEX format for for github.com/opencontainers/runc dependency.

- Skip cyrillic validation in VEX files

---------

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
Signed-off-by: Maksim Khimchenko <maksim.khimchenko@flant.com>
Co-authored-by: Maksim Khimchenko <maksim.khimchenko@flant.com>

(cherry picked from commit ab74177)
Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
diafour added a commit to deckhouse/3p-kubevirt that referenced this pull request Jul 9, 2026
@diafour
backport: fix: mitigate CVEs based on report 2026-06-29 (#136)
80a3eca 
Backport for release 1.9.

* fix: mitigate CVEs based on report 2026-06-29

Updated CVE-related replacements
- golang.org/x/crypto -> v0.52.0
- golang.org/x/net -> v0.55.0
- golang.org/x/oauth2 -> v0.34.0
- Go 1.24 -> Go 1.25

See deckhouse/virtualization#2557

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
diafour added a commit to deckhouse/3p-kubevirt that referenced this pull request Jul 9, 2026
@diafour
backport: fix: mitigate CVEs based on report 2026-06-29 (#136)
9e71561 
Backport for release 1.9.

* fix: mitigate CVEs based on report 2026-06-29

Updated CVE-related replacements
- golang.org/x/crypto -> v0.52.0
- golang.org/x/net -> v0.55.0
- golang.org/x/oauth2 -> v0.34.0
- Go 1.24 -> Go 1.25

See deckhouse/virtualization#2557

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
diafour added a commit that referenced this pull request Jul 9, 2026
@diafour
chore(core): mitigate CVEs based on report 2026-06-29 (#2557)
509a119 
* chore(core): mitigate CVEs based on report 2026-06-29

- Mitigate Trivy-reported High/Critical vulnerabilities in dependencies.

Updated CVE-related replacements:
golang.org/x/crypto -> v0.52.0
golang.org/x/net -> v0.55.0
golang.org/x/oauth2 -> v0.34.0

- Fixed vulnerabilities:
  - CVE-2026-25680
  - CVE-2026-25681
  - CVE-2026-27136
  - CVE-2026-33814
  - CVE-2026-39821
  - CVE-2026-39827
  - CVE-2026-39828
  - CVE-2026-39829
  - CVE-2026-39830
  - CVE-2026-39832
  - CVE-2026-39835
  - CVE-2026-42502
  - CVE-2026-42506
  - CVE-2026-42508
  - CVE-2026-46595
  - CVE-2026-46597
  - CVE-2026-53935

- Add CVE-2026-41579 justification in VEX format for for github.com/opencontainers/runc dependency.

- Skip cyrillic validation in VEX files

---------

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
Signed-off-by: Maksim Khimchenko <maksim.khimchenko@flant.com>
Co-authored-by: Maksim Khimchenko <maksim.khimchenko@flant.com>

(cherry picked from commit ab74177)
Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
diafour added a commit that referenced this pull request Jul 9, 2026
@diafour
chore(core): mitigate CVEs based on report 2026-06-29 (#2557)
a6e9636 
* chore(core): mitigate CVEs based on report 2026-06-29

- Mitigate Trivy-reported High/Critical vulnerabilities in dependencies.

Updated CVE-related replacements:
golang.org/x/crypto -> v0.52.0
golang.org/x/net -> v0.55.0
golang.org/x/oauth2 -> v0.34.0

- Fixed vulnerabilities:
  - CVE-2026-25680
  - CVE-2026-25681
  - CVE-2026-27136
  - CVE-2026-33814
  - CVE-2026-39821
  - CVE-2026-39827
  - CVE-2026-39828
  - CVE-2026-39829
  - CVE-2026-39830
  - CVE-2026-39832
  - CVE-2026-39835
  - CVE-2026-42502
  - CVE-2026-42506
  - CVE-2026-42508
  - CVE-2026-46595
  - CVE-2026-46597
  - CVE-2026-53935

- Add CVE-2026-41579 justification in VEX format for for github.com/opencontainers/runc dependency.

- Skip cyrillic validation in VEX files

---------

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
Signed-off-by: Maksim Khimchenko <maksim.khimchenko@flant.com>
Co-authored-by: Maksim Khimchenko <maksim.khimchenko@flant.com>

(cherry picked from commit ab74177)
Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@LopatinDmitr LopatinDmitr LopatinDmitr approved these changes
@universal-itengineer universal-itengineer Awaiting requested review from universal-itengineer universal-itengineer is a code owner
@nevermarine nevermarine Awaiting requested review from nevermarine nevermarine is a code owner
@Isteb4k Isteb4k Awaiting requested review from Isteb4k Isteb4k is a code owner
@yaroslavborbat yaroslavborbat Awaiting requested review from yaroslavborbat yaroslavborbat is a code owner

Assignees

@diafour diafour

Labels

None yet

Projects

None yet

Milestone

v1.10.0

Development

Successfully merging this pull request may close these issues.

3 participants

@diafour @LopatinDmitr @himax1991