CVE Fixes #104

sriramr98 · 2025-03-26T07:30:40Z

Changes proposed in this PR:

Updated go version to 1.23.7 to 1.20.3
Updated multiple dependencies with vulnerabilities to a later version without vulnerabilities

How I've tested this PR:

Ran tests locally

How I expect reviewers to test this PR:

Checklist:

Tests added
CHANGELOG entry added

hashicorp-cla-app · 2025-03-26T07:30:54Z

All committers have signed the CLA.

srahul3

✅ LGTM

consul-lambda/consul-lambda-extension/extension.go

sreeram77

LGTM!

srahul3

✅ LGTM

dduzgun-security

@sriramr98 Thanks a lot for looking into it.
Few comments but the rest looks good. I'll look at the CI too so we can fix it and merge

dduzgun-security · 2025-03-28T15:51:15Z

.github/workflows/bin-ci.yml

@@ -96,7 +96,7 @@ jobs:
          --junitfile "$TEST_RESULTS_DIR/${{ matrix.consul-version }}/gotestsum-report.xml" -- \
          -race "${PACKAGE_NAMES[@]}" \
          -- "$FLAG"
-    - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+    - uses: actions/upload-artifact@v4


We should pin the GitHub Action for better security.

Suggested change

- uses: actions/upload-artifact@v4

- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2

dduzgun-security · 2025-03-28T15:51:40Z

.github/workflows/build.yml

@@ -55,7 +55,7 @@ jobs:
          version: ${{ needs.get-product-version.outputs.product-version }}
          product: ${{ env.PRD_NAME }}
          repositoryOwner: "hashicorp"
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      - uses: actions/upload-artifact@v4


We should pin the GitHub Action for better security.

Suggested change

- uses: actions/upload-artifact@v4

- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2

dduzgun-security · 2025-03-28T15:52:00Z

.github/workflows/build.yml

@@ -105,13 +105,13 @@ jobs:
          zip -r out/${{ env.EXT_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ env.GOOS }}_${{ env.GOARCH }}.zip extensions/

      - name: Upload consul-lambda-registrator
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@v4


We should pin the GitHub Action for better security.

Suggested change

uses: actions/upload-artifact@v4

uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2

dduzgun-security · 2025-03-28T15:52:20Z

.github/workflows/build.yml

        with:
          name: ${{ env.REG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ env.GOOS }}_${{ env.GOARCH }}.zip
          path: ./consul-lambda/out/${{ env.REG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ env.GOOS }}_${{ env.GOARCH }}.zip

      - name: Upload consul-lambda-extension
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+        uses: actions/upload-artifact@v4


We should pin the GitHub Action for better security.

Suggested change

uses: actions/upload-artifact@v4

uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2

dduzgun-security · 2025-03-28T15:53:42Z

.github/workflows/build.yml

@@ -169,7 +169,7 @@ jobs:
      git-short-sha: ${{ needs.get-product-version.outputs.git-short-sha }}
    steps:
      - name: Download image artifact
-        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        uses: actions/download-artifact@v4


We should pin the GitHub Action for better security.

Suggested change

uses: actions/download-artifact@v4

uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e #v4.2.1

dduzgun-security · 2025-03-28T15:54:29Z

.github/workflows/terraform-ci.yml

@@ -121,7 +125,7 @@ jobs:
          --junitfile "$TEST_RESULTS/gotestsum-report.xml" \
          --format standard-verbose -- \
          ./... -p 1 -timeout 90m -v -failfast
-    - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+    - uses: actions/upload-artifact@v4


We should pin the GitHub Action for better security.

Suggested change

- uses: actions/upload-artifact@v4

- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2

dduzgun-security · 2025-03-28T15:56:14Z

.github/workflows/build.yml

@@ -139,7 +139,7 @@ jobs:
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2

      - name: Docker Build
-        uses: hashicorp/actions-docker-build@v1
+        uses: hashicorp/actions-docker-build@v2


We should pin the GitHub Action for better security.

Suggested change

uses: hashicorp/actions-docker-build@v2

uses: hashicorp/actions-docker-build@11d43ef520c65f58683d048ce9b47d6617893c9a #v2

dduzgun-security · 2025-03-28T15:57:17Z

.github/workflows/terraform-ci.yml

@@ -24,9 +24,9 @@ jobs:
    - name: Checkout
      uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # v2.0.3
+      uses: hashicorp/setup-terraform@v3


We should pin the GitHub Action for better security.

Suggested change

uses: hashicorp/setup-terraform@v3

uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd #v3.1.2

dduzgun-security · 2025-03-28T15:57:42Z

.github/workflows/terraform-ci.yml

@@ -108,6 +108,10 @@ jobs:
        aws configure set role_arn "${{ secrets.AWS_ROLE_ARN }}"
        aws configure set region us-west-2
        aws configure set source_profile lambda_user
+    - name: Setup Terraform
+      uses: hashicorp/setup-terraform@v3


We should pin the GitHub Action for better security.

Suggested change

uses: hashicorp/setup-terraform@v3

uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd #v3.1.2

* Updated some more vulnerable dependency versions in tests

… from v3 to v4 for Github Actions

…er action dependency which fails tests by default as it's deprecated

…-> `proxyConfig`

…ecide whether or not to enforce mTLs.

…on issues. Squashing related commits for sanity.

sriramr98 requested a review from a team as a code owner March 26, 2025 07:30

sriramr98 requested a review from a team as a code owner March 26, 2025 08:57

sriramr98 requested a review from sarahethompson March 26, 2025 08:57

sriramr98 force-pushed the sriramr98/cve_fixes branch from f8bbafe to b8896aa Compare March 26, 2025 09:04

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 26, 2025 15:43 — with GitHub Actions Inactive

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 26, 2025 15:48 — with GitHub Actions Inactive

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 26, 2025 15:57 — with GitHub Actions Inactive

srahul3 previously approved these changes Mar 27, 2025

View reviewed changes

sreeram77 reviewed Mar 27, 2025

View reviewed changes

consul-lambda/consul-lambda-extension/extension.go Outdated Show resolved Hide resolved

sriramr98 dismissed srahul3’s stale review via c065c5e March 27, 2025 07:33

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 27, 2025 07:35 — with GitHub Actions Inactive

sreeram77 previously approved these changes Mar 27, 2025

View reviewed changes

sriramr98 dismissed sreeram77’s stale review via 930ee55 March 28, 2025 03:18

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 28, 2025 03:20 — with GitHub Actions Inactive

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 28, 2025 03:23 — with GitHub Actions Inactive

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 28, 2025 03:30 — with GitHub Actions Inactive

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 28, 2025 06:00 — with GitHub Actions Inactive

srahul3 previously approved these changes Mar 28, 2025

View reviewed changes

dduzgun-security reviewed Mar 28, 2025

View reviewed changes

sriramr98 dismissed srahul3’s stale review via cb14b40 March 29, 2025 12:31

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 29, 2025 12:53 — with GitHub Actions Inactive

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 29, 2025 12:56 — with GitHub Actions Inactive

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 29, 2025 13:00 — with GitHub Actions Inactive

sriramr98 force-pushed the sriramr98/cve_fixes branch from bccf70f to 76227cc Compare March 29, 2025 13:01

sriramr98 temporarily deployed to dockerhub/hashicorpdev March 29, 2025 13:03 — with GitHub Actions Inactive

sriramr98 added 4 commits March 29, 2025 18:38

updated dependencies to later version for CVE fixes.

c479b1a

* updated version of golangci-lint in workflow

1cb5f2d

* Updated some more vulnerable dependency versions in tests

updated actions/upload-artifact and actions/download-artifact version…

15a3f58

… from v3 to v4 for Github Actions

Upgraded golangci-lint version to the latest version

a9a7c89

sriramr98 added 13 commits March 29, 2025 18:38

Updated terraform action version to v3

8457c39

Updated terraform action version to v3

d1c426a

Updated hashicorp.actions-docker-build to v2 since v1 contains an old…

9e1bdc5

…er action dependency which fails tests by default as it's deprecated

Removed unwanted terraform dependency init

4ae93c1

Added terraform setup step in acceptance tests CI

6f2aa4b

Updated consul version in unit tests CI

fc25cd5

Reverted InsecureSkipVerify to default behaviour in extension.go …

b71276a

…-> `proxyConfig`

Added a debug log - to be reverted after debugging

63b2cd9

Added a debug log - to be reverted after debugging

08645f0

Reverting the debug log

9198c00

Added version.go to keep track of the version which is then used to d…

cf57145

…ecide whether or not to enforce mTLs.

Trying to increase VPC quota through CLI which failed due to permissi…

1a67b64

…on issues. Squashing related commits for sanity.

Hardcoded specific workflow action ID for security purposes.

32878aa

sriramr98 force-pushed the sriramr98/cve_fixes branch from 8695981 to 32878aa Compare March 29, 2025 13:08

Vikramarjuna previously approved these changes Mar 29, 2025

View reviewed changes

Fixed spacing issue in workflow files

3b22ae1

sriramr98 dismissed Vikramarjuna’s stale review via 3b22ae1 March 31, 2025 12:16

sriramr98 deployed to dockerhub/hashicorpdev March 31, 2025 12:18 — with GitHub Actions Active

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE Fixes #104

CVE Fixes #104

sriramr98 commented Mar 26, 2025

hashicorp-cla-app bot commented Mar 26, 2025 •

edited

Loading

srahul3 left a comment

sreeram77 left a comment

srahul3 left a comment

dduzgun-security left a comment

dduzgun-security Mar 28, 2025

dduzgun-security Mar 28, 2025

dduzgun-security Mar 28, 2025

dduzgun-security Mar 28, 2025

dduzgun-security Mar 28, 2025

dduzgun-security Mar 28, 2025

dduzgun-security Mar 28, 2025

dduzgun-security Mar 28, 2025

dduzgun-security Mar 28, 2025

	- uses: actions/upload-artifact@v4
	- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2

	uses: actions/upload-artifact@v4
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 #v4.6.2

	uses: actions/download-artifact@v4
	uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e #v4.2.1

	uses: hashicorp/actions-docker-build@v2
	uses: hashicorp/actions-docker-build@11d43ef520c65f58683d048ce9b47d6617893c9a #v2

	uses: hashicorp/setup-terraform@v3
	uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd #v3.1.2

CVE Fixes #104

Are you sure you want to change the base?

CVE Fixes #104

Conversation

sriramr98 commented Mar 26, 2025

Changes proposed in this PR:

How I've tested this PR:

How I expect reviewers to test this PR:

Checklist:

hashicorp-cla-app bot commented Mar 26, 2025 • edited Loading

srahul3 left a comment

Choose a reason for hiding this comment

sreeram77 left a comment

Choose a reason for hiding this comment

srahul3 left a comment

Choose a reason for hiding this comment

dduzgun-security left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hashicorp-cla-app bot commented Mar 26, 2025 •

edited

Loading