[master] MGMT-24598: CVE-2026-42306 Bump assisted-service dep to pick up docker v28.5.2 - #2219
[master] MGMT-24598: CVE-2026-42306 Bump assisted-service dep to pick up docker v28.5.2#2219shay23bra wants to merge 2 commits into
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@shay23bra: This pull request references MGMT-24598 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
size/XXL
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: shay23bra The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
WalkthroughThe PR updates direct and indirect Go dependencies, refreshes assisted-service and OCM API replacement pins, and applies ChangesDependency and testing updates
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Line 70: Update the github.com/docker/docker dependency declaration to version
29.5.1 or newer so it is no longer affected by CVE-2026-42306; if Docker
functionality is intentionally unreachable, document that exception instead of
leaving the vulnerable version unchanged.
- Line 98: Update the github.com/jackc/pgx/v5 dependency declaration in go.mod
from v5.6.0 to v5.9.0 or later, ensuring the resolved module metadata remains
consistent with the upgraded version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| github.com/docker/distribution v2.8.2+incompatible // indirect | ||
| github.com/docker/docker v27.3.1+incompatible // indirect | ||
| github.com/docker/go-connections v0.5.0 // indirect | ||
| github.com/docker/docker v28.5.2+incompatible // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '60,80p' go.mod
python3 - <<'PY'
import json, urllib.request
url = "https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-42306"
try:
with urllib.request.urlopen(url, timeout=20) as r:
data = json.load(r)
print(json.dumps({
"id": data.get("id"),
"summary": data.get("summary"),
"affected": data.get("affected", []),
}, indent=2)[:12000])
except Exception as e:
print(f"ERROR: {e}")
PYRepository: openshift/assisted-installer
Length of output: 1452
🌐 Web query:
OSV UBUNTU-CVE-2026-42306 Docker Engine 28.5.2 fixed in 29.5.1 github.com/docker/docker
💡 Result:
CVE-2026-42306 is a security vulnerability affecting Docker Engine and Moby Daemon [1][2]. It involves a race condition that occurs during the setup of a bind mount for the docker cp command [3][4]. A malicious container can exploit this race condition by replacing a destination path (or a parent path component) with a symbolic link after the mount point is created but before the mount syscall is executed [3][4]. This allows the container to redirect the bind mount target to an arbitrary path on the host, which can result in host file overwrites (if the volume is writable) or a denial of service (if the host path is masked by a read-only mount) [3][4]. The vulnerability is addressed in the following versions: - Docker Engine: Fixed in version 29.5.1 (affected versions include 28.5.2 and prior) [1][2][5]. - Moby Daemon: Fixed in version 2.0.0-beta.14 (affected versions include those prior to this release) [1][2][5]. To exploit this, an attacker must have a container with at least one volume mount, and a process within that container must be able to rapidly create and swap symlinks at the mount destination [3][4]. The vulnerability is triggered when an operator initiates a docker cp operation (or calls related API endpoints like PUT /containers/{id}/archive or HEAD /containers/{id}/archive) into the affected container [3][4].
Citations:
- 1: https://ubuntu.com/security/CVE-2026-42306
- 2: https://nvd.nist.gov/vuln/detail/CVE-2026-42306
- 3: GHSA-rg2x-37c3-w2rh
- 4: GHSA-rg2x-37c3-w2rh
- 5: https://osv.dev/vulnerability/CVE-2026-42306
🏁 Script executed:
# Show the module context and any imports/usages of github.com/docker/docker
sed -n '1,120p' go.mod
printf '\n--- imports/usages ---\n'
rg -n 'github\.com/docker/docker|from Docker|docker/client|docker/api' . -g '!**/vendor/**'Repository: openshift/assisted-installer
Length of output: 7223
Bump github.com/docker/docker past v28.5.2
OSV marks 28.5.2 and earlier as affected by CVE-2026-42306; the fix is in 29.5.1. If Docker functionality is intentionally unreachable here, document that exception.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker
(GO-2026-4883)
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker
(GO-2026-4887)
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows bind mount redirection to host path in github.com/docker/docker
(GO-2026-5617)
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap in github.com/docker/docker
(GO-2026-5668)
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker
(GO-2026-5746)
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Moby has an Off-by-one error in its plugin privilege validation
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows bind mount redirection to host path
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Moby has AuthZ plugin bypass when provided oversized request bodies
[HIGH] 70-70: github.com/docker/docker 28.5.2+incompatible: Docker: PUT /containers/{id}/archive executes container binary on the host
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 70, Update the github.com/docker/docker dependency
declaration to version 29.5.1 or newer so it is no longer affected by
CVE-2026-42306; if Docker functionality is intentionally unreachable, document
that exception instead of leaving the vulnerable version unchanged.
Source: Linters/SAST tools
| github.com/jackc/pgtype v1.14.4 // indirect | ||
| github.com/jackc/pgx/v4 v4.18.3 // indirect | ||
| github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect | ||
| github.com/jackc/pgx/v5 v5.6.0 // indirect |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- go.mod excerpt ---\n'
nl -ba go.mod | sed -n '80,120p'
printf '\n--- direct references to pgx/v5 ---\n'
rg -n 'github.com/jackc/pgx/v5|pgx/v5' . -g '!**/vendor/**' || true
printf '\n--- module graph entries if available in repo metadata ---\n'
git ls-files '*go.sum' '*go.mod' | sed -n '1,20p'Repository: openshift/assisted-installer
Length of output: 257
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- go.mod excerpt ---'
nl -ba go.mod | sed -n '80,120p'
echo
echo '--- direct references to pgx/v5 ---'
rg -n 'github.com/jackc/pgx/v5|pgx/v5' . -g '!**/vendor/**' || true
echo
echo '--- go.sum occurrences ---'
rg -n 'github.com/jackc/pgx/v5' go.sum || trueRepository: openshift/assisted-installer
Length of output: 229
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- go.mod excerpt (lines 80-120) ---'
awk 'NR>=80 && NR<=120 { printf "%5d %s\n", NR, $0 }' go.mod
echo
echo '--- direct references to pgx/v5 in repository ---'
rg -n 'github.com/jackc/pgx/v5|pgx/v5' . -g '!**/vendor/**' || true
echo
echo '--- go.sum occurrences ---'
rg -n 'github.com/jackc/pgx/v5' go.sum || trueRepository: openshift/assisted-installer
Length of output: 3100
🌐 Web query:
OSV GO-2026-4771 github.com/jackc/pgx/v5 v5.6.0 fixed versions v5.9.0 v5.9.2
💡 Result:
The vulnerability GO-2026-4771 (also identified as CVE-2026-33815 and GHSA-xgrm-4fwx-7qm8) is a memory-safety issue in github.com/jackc/pgx/v5 that affects versions prior to v5.9.0 [1][2][3]. Although initial automated vulnerability reports and some security databases were delayed in reflecting the fix, it has been confirmed that the vulnerability is patched starting in version v5.9.0 [4]. The fix involves bounds checking and input validation in the pgproto3 package, specifically within Backend.Receive, Bind.Decode, and FunctionCall.Decode [1][4]. The version v5.9.0, as well as subsequent releases like v5.9.1 and v5.9.2, contain these security fixes [4][5][6]. Users of pgx/v5 are advised to update to at least version v5.9.0 to remediate this vulnerability [4][3].
Citations:
- 1: https://osv.dev/vulnerability/GO-2026-4771
- 2: https://pkg.go.dev/vuln/GO-2026-4771
- 3: GHSA-xgrm-4fwx-7qm8
- 4: x/vulndb: suggestion regarding GO-2026-4771 golang/vulndb#4943
- 5: https://github.com/jackc/pgx/blob/master/CHANGELOG.md
- 6: jackc/pgx@v5.9.0...v5.9.2
🌐 Web query:
GO-2026-4771 severity pgx/v5 OSV critical high
💡 Result:
GO-2026-4771 refers to a memory-safety vulnerability in the github.com/jackc/pgx/v5 Go module, specifically within the pgproto3 sub-package [1][2]. Key details include: - Severity: This vulnerability is classified as critical, with a CVSS v3.1 score of 9.8 [3][4][5]. - Affected Versions: Versions of github.com/jackc/pgx/v5 prior to v5.9.0 are affected [1][3]. - Resolution: The issue was addressed and fixed in version 5.9.0 [1][6][4]. - Vulnerability ID: It is also tracked as CVE-2026-33815 and GHSA-xgrm-4fwx-7qm8 [1][7][3]. The vulnerability affects specific routines, namely Backend.Receive and Bind.Decode [1][7]. It was officially published on April 7, 2026 [1][3]. Users are advised to upgrade to version 5.9.0 or later to remediate this vulnerability [1][6].
Citations:
- 1: https://pkg.go.dev/vuln/GO-2026-4771
- 2: https://osv.dev/vulnerability/GO-2026-4771
- 3: GHSA-xgrm-4fwx-7qm8
- 4: https://deps.dev/advisory/osv/GHSA-xgrm-4fwx-7qm8
- 5: https://osv.dev/vulnerability/GHSA-9jj7-4m8r-rfcm
- 6: x/vulndb: suggestion regarding GO-2026-4771 golang/vulndb#4943
- 7: https://nvd.nist.gov/vuln/detail/cve-2026-33815
Upgrade github.com/jackc/pgx/v5 to v5.9.0 or later. go.mod:98 pins v5.6.0, which is affected by the critical GO-2026-4771 memory-safety vulnerability.
🧰 Tools
🪛 OSV Scanner (2.4.0)
[CRITICAL] 98-98: github.com/jackc/pgx/v5 5.6.0: CVE-2026-33815 in github.com/jackc/pgx
(GO-2026-4771)
[CRITICAL] 98-98: github.com/jackc/pgx/v5 5.6.0: CVE-2026-33816 in github.com/jackc/pgx
(GO-2026-4772)
[CRITICAL] 98-98: github.com/jackc/pgx/v5 5.6.0: SQL Injection via placeholder confusion with dollar quoted string literals in github.com/jackc/pgx
(GO-2026-5004)
[CRITICAL] 98-98: github.com/jackc/pgx/v5 5.6.0: Memory-safety vulnerability in github.com/jackc/pgx/v5.
[CRITICAL] 98-98: github.com/jackc/pgx/v5 5.6.0: pgx: SQL Injection via placeholder confusion with dollar quoted string literals
[CRITICAL] 98-98: github.com/jackc/pgx/v5 5.6.0: pgx contains memory-safety vulnerability
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 98, Update the github.com/jackc/pgx/v5 dependency declaration
in go.mod from v5.6.0 to v5.9.0 or later, ensuring the resolved module metadata
remains consistent with the upgraded version.
Source: Linters/SAST tools
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #2219 +/- ##
=======================================
Coverage 48.82% 48.82%
=======================================
Files 20 20
Lines 4397 4397
=======================================
Hits 2147 2147
Misses 2026 2026
Partials 224 224 🚀 New features to boost your workflow:
|
The Dockerfile already builds with GOFLAGS=-mod=mod. Align unit tests to use the same mode, avoiding issues with vendored packages that have subdirectories matching .gitignore patterns (e.g. build/).
|
@shay23bra: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Bump assisted-service dependency to latest commit which includes docker/docker v28.5.2, fixing CVE-2026-42306.
Summary by CodeRabbit