Skip to content

chore: bump versions to fix CVE - #244

Merged
niemeyer merged 6 commits into
canonical:mainfrom
zhijie-yang:vuln-fix-ssdlc-25.10
Sep 29, 2025
Merged

chore: bump versions to fix CVE#244
niemeyer merged 6 commits into
canonical:mainfrom
zhijie-yang:vuln-fix-ssdlc-25.10

Conversation

@zhijie-yang

@zhijie-yang zhijie-yang commented Sep 24, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor
  • Have you signed the CLA?

The minimal required Go version is bumped to 1.24.6 to fix GO-2025-3956/CVE-2025-47906. The Go version 1.23.12 cannot be used due to the unavailability in the snapstore.

The version of package github.com/ulikunitz/xz is bumped to v0.5.15 to fix GO-2025-3922/CVE-2025-58058.

A complete govulncheck before the fix goes as follows:

=== Symbol Results ===

Vulnerability #1: GO-2025-3956
    Unexpected paths returned from LookPath in os/exec
  More info: https://pkg.go.dev/vuln/GO-2025-3956
  Standard library
    Found in: os/[email protected]
    Fixed in: os/[email protected]
    Example traces found:
      #1: internal/testutil/exec.go:35:28: testutil.init#1 calls exec.LookPath

Vulnerability #2: GO-2025-3922
    Memory leaks when decoding a corrupted multiple LZMA archives in
    github.com/ulikunitz/xz
  More info: https://pkg.go.dev/vuln/GO-2025-3922
  Module: github.com/ulikunitz/xz
    Found in: github.com/ulikunitz/[email protected]
    Fixed in: github.com/ulikunitz/[email protected]
    Example traces found:
      #1: internal/deb/extract.go:18:2: deb.init calls xz.init, which eventually calls hash.init
      #2: internal/cache/cache.go:160:25: cache.Cache.Read calls io.ReadAll, which eventually calls lzma.ByteReader
      #3: internal/cache/cache.go:160:25: cache.Cache.Read calls io.ReadAll, which eventually calls lzma.DecodeDictCap
      #4: internal/testutil/filecontentchecker.go:84:45: testutil.fileContentCheck calls lzma.Properties.String
      #5: internal/cache/cache.go:160:25: cache.Cache.Read calls io.ReadAll, which eventually calls lzma.Reader2.Read
      #6: internal/cache/cache.go:160:25: cache.Cache.Read calls io.ReadAll, which eventually calls lzma.Reader2Config.NewReader2
      #7: internal/deb/extract.go:403:33: deb.DataReader calls xz.NewReader, which eventually calls lzma.Reader2Config.Verify
      #8: internal/cache/cache.go:160:25: cache.Cache.Read calls io.ReadAll, which eventually calls lzma.breader.ReadByte
      #9: internal/testutil/filecontentchecker.go:84:45: testutil.fileContentCheck calls lzma.chunkHeader.String
      #10: internal/testutil/filecontentchecker.go:84:45: testutil.fileContentCheck calls lzma.chunkType.String
      #11: internal/pgputil/openpgp.go:90:19: pgputil.VerifySignature calls io.Copy, which eventually calls lzma.decoderDict.Write
      #12: internal/deb/extract.go:18:2: deb.init calls xz.init, which calls lzma.init
      #13: internal/deb/extract.go:403:33: deb.DataReader calls xz.NewReader, which eventually calls xlog.Debugf
      #14: internal/deb/extract.go:18:2: deb.init calls xz.init, which calls xlog.init
      #15: internal/deb/extract.go:403:33: deb.DataReader calls xz.NewReader
      #16: internal/cache/cache.go:160:25: cache.Cache.Read calls io.ReadAll, which calls xz.Reader.Read
      #17: internal/testutil/filecontentchecker.go:84:45: testutil.fileContentCheck calls xz.blockHeader.String
      #18: internal/cache/cache.go:160:25: cache.Cache.Read calls io.ReadAll, which eventually calls xz.countingReader.Read
      #19: internal/testutil/filecontentchecker.go:84:45: testutil.fileContentCheck calls xz.footer.String
      #20: internal/testutil/filecontentchecker.go:84:45: testutil.fileContentCheck calls xz.header.String
      #21: internal/deb/extract.go:18:2: deb.init calls xz.init
      #22: internal/testutil/filecontentchecker.go:84:45: testutil.fileContentCheck calls xz.lzmaFilter.String
      #23: internal/deb/extract.go:388:33: deb.DataReader calls ar.Reader.Next, which eventually calls xz.noneHash.Write

Your code is affected by 2 vulnerabilities from 1 module and the Go standard library.
This scan also found 0 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.
Use '-show verbose' for more details.

There are no vulnerabilities found after this version bump.

@github-actions

github-actions Bot commented Sep 24, 2025 •
edited
Loading

Copy link
Copy Markdown
Command Mean [s] Min [s] Max [s] Relative
BASE 8.867 ± 0.055 8.777 8.966 1.04 ± 0.01
HEAD 8.557 ± 0.042 8.506 8.607 1.00

@zhijie-yang
zhijie-yang marked this pull request as draft September 24, 2025 13:28
@zhijie-yang
zhijie-yang marked this pull request as ready for review September 24, 2025 14:02
letFunny
letFunny reviewed Sep 24, 2025
View reviewed changes

@letFunny letFunny left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks James for working on this so proactively! Only a few minor questions.

Comment thread cmd/chisel/cmd_info.go Resolved
Comment thread go.mod
module github.com/canonical/chisel

go 1.23.8
go 1.24.6

@letFunny letFunny Sep 24, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not go for 1.25 now that we are updating. The last time we discussed this (Gustavo & me) the problem is that only the last two major versions are supported officially by the Go team, so if we could update to the latest that would mean we don't have to upgrade as often.

Not saying we have to do it, just asking.

@zhijie-yang zhijie-yang Sep 24, 2025

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's a good consideration. The major reason pushing us away from doing this is that go 1.25 is still on the edge channel of the go snap. A minor reason is that we cannot necessarily save the efforts of bumping versions, as vulnerabilities can also exist in newer minor versions with older patch version numbers.

@letFunny letFunny Sep 25, 2025

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The major reason pushing us away from doing this is that go 1.25 is still on the edge channel of the go snap.

This is enough reason for me. Thanks for the context

letFunny
letFunny approved these changes Sep 25, 2025
View reviewed changes

@letFunny letFunny left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this James, greatly appreciated!

@letFunny letFunny added the Simple Nice for a quick look on a minute or two label Sep 25, 2025
niemeyer
niemeyer approved these changes Sep 29, 2025
View reviewed changes

@niemeyer niemeyer left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@niemeyer

niemeyer commented Sep 29, 2025

Copy link
Copy Markdown
Contributor

There are no vulnerabilities found after this version bump.

Famous last words. ;-)

@niemeyer
niemeyer merged commit 54825ba into canonical:main Sep 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@niemeyer niemeyer niemeyer approved these changes
+1 more reviewer
@letFunny letFunny letFunny approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

Simple Nice for a quick look on a minute or two

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@zhijie-yang @niemeyer @letFunny