chore: update Go version to 1.22.12 for security fixes #211

nilsdebruin · 2025-03-26T10:16:18Z

chore: update go.mod and go.sum with latest dependencies available to go 1.22.12

Have you signed the CLA?

chore: update go.mod and go.sum with latest dependencies fix: fix versions fix: fix to correct version fix: updated x/term version fix: updated crypto fix: new version fix: new version fix: new version

nilsdebruin · 2025-03-26T10:18:03Z

During building of Chisel and using the Chisel version, Docker Hub alerted me for security issues with Go. Therefore, I have created this PR to include the newest minor version of Go for this release (1.22.12) and also walked through the packages to see which ones could be upgraded.

github-actions · 2025-03-26T10:22:22Z

Command	Mean [s]	Min [s]	Max [s]	Relative
`BASE`	8.893 ± 0.303	8.539	9.299	1.06 ± 0.04
`HEAD`	8.363 ± 0.172	8.230	8.771	1.00

letFunny

Thanks for looking into this! I see that the benchmark says there is a 5% slowdown which is weird. I ran it locally and it seems the slowdown is artificial, probably because of the instability of Github Actions, so let's get this merged!

letFunny

On second thought, @nilsdebruin can you give more details about how this was flagged and where? I am curious to know if we can solve this without pinning the minor version and only updating the dependencies.

nilsdebruin · 2025-03-28T08:35:40Z

@letFunny Yes of course! I added the releases to one of my containers and uploaded them to Dockerhub. This runs docker scout automatically and it found several CVE's there. When I updated to 1.22.12, I only had one critical CVE. I now made a version with go 1.24.1 as well and than there are no CVE's left. If needed we can have a quick chat / call!

letFunny · 2025-03-28T11:11:18Z

For context, the team and me were looking into this today. This happens because trivy has different reporting capabilities with its different options. We are using trivy fs in the CI which checks go.mod and it didn't detect any CVE. The problem here is that Go uses the latest versions if they are not pinned so the go.mod is not vulnerable as long as your local compiler version is more up to date than go 1.22.12.

Again, because the binaries we published were created with an older version of the compiler they also have these vulnerabilities. In reality, we are not affected by any of these CVEs but we agree it's better to solve it than to have false positives.

As to what version of Go to use we prefer to pin the patch version to go 1.22.12 rather than upgrading to go 1.24 which is not present on the major Ubuntu releases yet. So let's please continue with this PR and close #212. Lastly, @nilsdebruin can you sign the CLA?

letFunny · 2025-03-28T11:12:18Z

For context, this is how you get to the CVEs by using an old compiler version:

$ go install golang.org/dl/go1.22.2@latest
$ go1.22.2 download
$ go1.22.2 build ./cmd/chisel
$ trivy rootfs chisel

The output is:

chisel (gobinary)

Total: 10 (UNKNOWN: 0, LOW: 0, MEDIUM: 7, HIGH: 2, CRITICAL: 1)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬──────────────────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability  │ Severity │ Status │ Installed Version │        Fixed Version         │                            Title                             │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib  │ CVE-2024-24790 │ CRITICAL │ fixed  │ v1.22.2           │ 1.21.11, 1.22.4              │ golang: net/netip: Unexpected behavior from Is methods for   │
│         │                │          │        │                   │                              │ IPv4-mapped IPv6 addresses                                   │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-24790                   │
│         ├────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2024-24788 │ HIGH     │        │                   │ 1.22.3                       │ golang: net: malformed DNS message can cause infinite loop   │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-24788                   │
│         ├────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2024-34156 │          │        │                   │ 1.22.7, 1.23.1               │ encoding/gob: golang: Calling Decoder.Decode on a message    │
│         │                │          │        │                   │                              │ which contains deeply nested structures...                   │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-34156                   │
│         ├────────────────┼──────────┤        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2024-24789 │ MEDIUM   │        │                   │ 1.21.11, 1.22.4              │ golang: archive/zip: Incorrect handling of certain ZIP files │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-24789                   │
│         ├────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2024-24791 │          │        │                   │ 1.21.12, 1.22.5              │ net/http: Denial of service due to improper 100-continue     │
│         │                │          │        │                   │                              │ handling in net/http                                         │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-24791                   │
│         ├────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2024-34155 │          │        │                   │ 1.22.7, 1.23.1               │ go/parser: golang: Calling any of the Parse functions        │
│         │                │          │        │                   │                              │ containing deeply nested literals...                         │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-34155                   │
│         ├────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2024-34158 │          │        │                   │                              │ go/build/constraint: golang: Calling Parse on a "// +build"  │
│         │                │          │        │                   │                              │ build tag line with...                                       │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-34158                   │
│         ├────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2024-45336 │          │        │                   │ 1.22.11, 1.23.5, 1.24.0-rc.2 │ golang: net/http: net/http: sensitive headers incorrectly    │
│         │                │          │        │                   │                              │ sent after cross-domain redirect                             │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-45336                   │
│         ├────────────────┤          │        │                   │                              ├──────────────────────────────────────────────────────────────┤
│         │ CVE-2024-45341 │          │        │                   │                              │ golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can │
│         │                │          │        │                   │                              │ bypass URI name...                                           │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2024-45341                   │
│         ├────────────────┤          │        │                   ├──────────────────────────────┼──────────────────────────────────────────────────────────────┤
│         │ CVE-2025-22866 │          │        │                   │ 1.22.12, 1.23.6, 1.24.0-rc.3 │ crypto/internal/nistec: golang: Timing sidechannel for P-256 │
│         │                │          │        │                   │                              │ on ppc64le in crypto/internal/nistec                         │
│         │                │          │        │                   │                              │ https://avd.aquasec.com/nvd/cve-2025-22866                   │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴──────────────────────────────┴──────────────────────────────────────────────────────────────┘

nilsdebruin · 2025-03-28T12:02:38Z

@letFunny I already signed the CLA, strange! I tried again and got this:

The provided email address is already associated with a CLA

letFunny · 2025-03-28T15:07:06Z

Let's wait on #210 and see if it's because of the version of the action

letFunny · 2025-03-31T09:14:34Z

@nilsdebruin Can you merge against main to get the latest version of the CI actions?

letFunny · 2025-03-31T09:58:32Z

@nilsdebruin I mean updating your branch locally by pulling the latest changes from main so, depending on your setup, you need to click "Sync" in your fork in Github and then:

git checkout main
git pull
git checkout feature/update-go
git merge main
git push

There is a myriad of ways of doing it, this is only one of them.

nilsdebruin · 2025-03-31T09:59:11Z

@nilsdebruin I mean updating your branch locally by pulling the latest changes from main so, depending on your setup, you need to click "Sync" in your fork in Github and then:
git checkout main
git pull
git checkout feature/update-go
git merge main
git push
There is a myriad of ways of doing it, this is only one of them.

@letFunny sorry for misunderstanding, will follow your steps!

nilsdebruin · 2025-03-31T15:14:12Z

@letFunny should be good to go now!

niemeyer

Thanks for the updates!

TopLevelControl was disabled accidentally on canonical#211. The old Starlark API had it enabled by default and the new one does not.

TopLevelControl was disabled accidentally on #211. The old Starlark API had it enabled by default and the new one does not.

chore: update Go version to 1.22.12 for security fixes

2028097

chore: update go.mod and go.sum with latest dependencies fix: fix versions fix: fix to correct version fix: updated x/term version fix: updated crypto fix: new version fix: new version fix: new version

cjdcordeiro requested a review from letFunny March 26, 2025 11:12

letFunny approved these changes Mar 27, 2025

View reviewed changes

letFunny reviewed Mar 27, 2025

View reviewed changes

letFunny self-requested a review March 27, 2025 09:50

nilsdebruin added 3 commits March 31, 2025 12:00

Merge branch 'main' into feature/update-go

956eff3

fix: update linting issue

74bd49d

fix: further linting fixes

3b48799

Merge branch 'main' into feature/update-go

1f3d4e5

niemeyer approved these changes Apr 1, 2025

View reviewed changes

niemeyer merged commit 803b709 into canonical:main Apr 1, 2025
16 checks passed

nilsdebruin mentioned this pull request Apr 1, 2025

chore: update to Go 1.24 and dependencies #212

Closed

1 task

letFunny added a commit to letFunny/chisel that referenced this pull request Apr 3, 2025

bugfix: revert disabling TopLevelControl

f8edd92

TopLevelControl was disabled accidentally on canonical#211. The old Starlark API had it enabled by default and the new one does not.

letFunny mentioned this pull request Apr 3, 2025

bugfix: revert disabling TopLevelControl #214

Merged

1 task

niemeyer pushed a commit that referenced this pull request Apr 4, 2025

bugfix: revert disabling TopLevelControl (#214)

8c3d530

TopLevelControl was disabled accidentally on #211. The old Starlark API had it enabled by default and the new one does not.

chore: update Go version to 1.22.12 for security fixes #211

chore: update Go version to 1.22.12 for security fixes #211

Uh oh!

Conversation

nilsdebruin commented Mar 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nilsdebruin commented Mar 26, 2025

Uh oh!

github-actions bot commented Mar 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

letFunny left a comment

Choose a reason for hiding this comment

Uh oh!

letFunny left a comment

Choose a reason for hiding this comment

Uh oh!

nilsdebruin commented Mar 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

letFunny commented Mar 28, 2025

Uh oh!

letFunny commented Mar 28, 2025

Uh oh!

nilsdebruin commented Mar 28, 2025

Uh oh!

letFunny commented Mar 28, 2025

Uh oh!

letFunny commented Mar 31, 2025

Uh oh!

letFunny commented Mar 31, 2025

Uh oh!

nilsdebruin commented Mar 31, 2025

Uh oh!

nilsdebruin commented Mar 31, 2025

Uh oh!

niemeyer left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nilsdebruin commented Mar 26, 2025 •

edited

Loading

github-actions bot commented Mar 26, 2025 •

edited

Loading

nilsdebruin commented Mar 28, 2025 •

edited

Loading