Security: Fix CVE-2026-39829/42508/46598 (x/crypto) + CVE-2026-39821 (x/net) on release-v0.27.x#2831
Conversation
…v0.55.0 Addresses multiple Critical/High CVEs in golang.org/x/crypto: - CVE-2026-39829 (GO-2026-5018): DoS via pathological RSA/DSA parameters in x/crypto/ssh - CVE-2026-42508 (GO-2026-5021): x/crypto vulnerability fixed in v0.52.0 - CVE-2026-46598 (GO-2026-5033): x/crypto vulnerability fixed in v0.52.0 - Several additional CVEs in x/crypto fixed in v0.52.0 - CVE-2026-39821 (GO-2026-5026): x/net/idna domain name validation bypass (CVSS 10.0) Changes: - golang.org/x/crypto v0.21.0 → v0.52.0 - golang.org/x/net v0.23.0 → v0.55.0 (Critical CVSS 10.0) - golang.org/x/sys v0.20.0 → v0.45.0 (fixes CVE-2026-39824) - golang.org/x/sync v0.6.0 → v0.20.0 (transitive) - golang.org/x/term, x/text bumped accordingly - Vendor directory updated via go mod vendor Resolves: SRVKP-12342, SRVKP-12349, SRVKP-12351, SRVKP-12357 Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request upgrades the Go version to 1.25.0 and updates several golang.org/x dependencies in go.mod and go.sum. However, this Go version bump will break the build because other repository configuration files, such as the Makefile and Dockerfile, remain pinned to Go 1.21.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| module github.com/openshift-pipelines/pipelines-as-code | ||
|
|
||
| go 1.21 | ||
| go 1.25.0 |
There was a problem hiding this comment.
Bumping the Go version to 1.25.0 in go.mod is necessary to support the upgraded golang.org/x/* dependencies. However, this change will completely break the build because other configuration files in the repository are still pinned to Go 1.21:
Makefile: Line 3 definesGO_TOOLCHAIN ?= go1.21.13and lines 13-14 exportGOTOOLCHAINas$(GO_TOOLCHAIN). When building via the Makefile, Go will strictly enforce thego1.21.13toolchain, which cannot compile a module requiringgo 1.25.0.Dockerfile: Line 1 usesFROM golang:1.21 as builder, which will fail to compile the application since the Go 1.21 compiler is older than Go 1.25.0.
Please update both the Makefile and Dockerfile to use Go 1.25.0 (or a compatible version like 1.25.x) so that the project builds successfully.
References
- The go directive in go.mod can include specific patch versions when automatically updated by go mod tidy to align with dependencies.
1 participant
Summary
This PR fixes multiple Critical/High CVEs in
golang.org/x/cryptoandgolang.org/x/neton therelease-v0.27.xbranch. Note: an earlier PR (#2807) brought x/crypto to v0.46.0, but newer vulnerability research identifies additional CVEs requiring v0.52.0+.CVE Details
Fix Summary
golang.org/x/cryptov0.21.0 → v0.52.0golang.org/x/netv0.23.0 → v0.55.0 (Critical CVSS 10.0)golang.org/x/sysv0.20.0 → v0.45.0golang.org/x/sync,x/term,x/textbumped transitivelygo mod vendorgo mod tidy+go mod verifyboth passTest Results
Status:⚠️ Pre-existing test failures (unrelated to this fix)
Tests run:
go test ./pkg/...Failure: Some GitLab provider tests fail due to pre-existing mock HTTP fixture mismatches — not related to cryptographic or network library changes.
Breaking Changes
None. All upgrades are within the same major version. golang.org/x/* libraries maintain backwards compatibility.
Verification Steps
govulncheck ./...no longer reports GO-2026-5018, GO-2026-5021, GO-2026-5026, GO-2026-5033Risk Assessment
Jira References
Resolves: SRVKP-12342, SRVKP-12349, SRVKP-12351, SRVKP-12357
🤖 Generated by CVE Fixer Workflow