Skip to content

Commit

Permalink
Bump google.golang.org/grpc to 1.56.3
Browse files Browse the repository at this point in the history 
This resolves [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487).
  • Loading branch information
@cthain @zalimeni
cthain authored and zalimeni committed Oct 27, 2023
1 parent 53a355b commit 343688d
Show file tree
Hide file tree
Showing 40 changed files with 2,022 additions and 235 deletions.
4 changes: 4 additions & 0 deletions .changelog/19414.txt
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
```release-note:security
Upgrade `google.golang.org/grpc` to 1.56.3.
This resolves vulnerability [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487).
```
2 changes: 1 addition & 1 deletion agent/grpc-internal/resolver/resolver.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ func (s *ServerResolverBuilder) Build(target resolver.Target, cc resolver.Client
}

//nolint:staticcheck
serverType, datacenter, err := parseEndpoint(target.Endpoint)
serverType, datacenter, err := parseEndpoint(target.Endpoint())
if err != nil {
return nil, err
}
Expand Down
3 changes: 2 additions & 1 deletion agent/grpc-internal/resolver/resolver_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package resolver
import (
"fmt"
"net"
"net/url"
"strings"
"testing"

Expand Down Expand Up @@ -40,7 +41,7 @@ func TestServerResolverBuilder(t *testing.T) {
_, err := rs.Build(resolver.Target{
Scheme: "consul",
Authority: rs.Authority(),
Endpoint: endpoint,
URL: url.URL{Opaque: endpoint},
}, cc, resolver.BuildOptions{})
require.NoError(t, err)

Expand Down
2 changes: 1 addition & 1 deletion agent/grpc-middleware/testutil/testservice/simple.pb.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

80 changes: 77 additions & 3 deletions agent/xds/z_xds_packages.go
View file

Large diffs are not rendered by default.

7 changes: 3 additions & 4 deletions build-support/scripts/envoy-library-references.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ if [[ ! -f GNUmakefile ]] || [[ ! -f go.mod ]]; then
exit 1
fi

readonly LIBRARY_VERSION="$(grep github.com/envoyproxy/go-control-plane go.mod | awk '{print $2}')"
readonly LIBRARY_VERSION="$(grep -e "github.com/envoyproxy/go-control-plane[[:space:]]" go.mod | awk '{print $2}')"
readonly OUTFILE=z_xds_packages.go

echo "Fetching envoyproxy/go-control-plane @ ${LIBRARY_VERSION}..."
Expand All @@ -39,7 +39,7 @@ trap "rm -rf _envoy_tmp" EXIT
(
cd _envoy_tmp

git clone git@github.com:envoyproxy/go-control-plane
git clone https://github.com/envoyproxy/go-control-plane
cd go-control-plane
git checkout -b consul-temp "${LIBRARY_VERSION}"

Expand All @@ -64,7 +64,6 @@ echo ")" >> "${OUTFILE}"
goimports -w "${OUTFILE}"

mv -f "${OUTFILE}" ../../agent/xds
)

echo "Generating a fresh troubleshoot ${OUTFILE} file..."
cat <<-EOF > "${OUTFILE}"
Expand All @@ -84,7 +83,7 @@ echo ")" >> "${OUTFILE}"

goimports -w "${OUTFILE}"

mv -f "${OUTFILE}" ../../troubleshoot/connect
mv -f "${OUTFILE}" ../../troubleshoot/proxy
)


Expand Down
43 changes: 23 additions & 20 deletions go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,8 @@ require (
github.com/coredns/coredns v1.10.1
github.com/coreos/go-oidc v2.1.0+incompatible
github.com/docker/go-connections v0.3.0
github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1
github.com/envoyproxy/go-control-plane v0.11.1
github.com/envoyproxy/go-control-plane/xdsmatcher v0.0.0-20231026140209-dc05a22efe95
github.com/fatih/color v1.14.1
github.com/fsnotify/fsnotify v1.5.1
github.com/go-openapi/runtime v0.25.0
Expand Down Expand Up @@ -91,7 +92,7 @@ require (
github.com/rboyer/safeio v0.2.3
github.com/ryanuber/columnize v2.1.2+incompatible
github.com/shirou/gopsutil/v3 v3.22.9
github.com/stretchr/testify v1.8.3
github.com/stretchr/testify v1.8.4
go.etcd.io/bbolt v1.3.7
go.opentelemetry.io/otel v1.16.0
go.opentelemetry.io/otel/metric v1.16.0
Expand All @@ -102,13 +103,13 @@ require (
golang.org/x/crypto v0.14.0
golang.org/x/exp v0.0.0-20230321023759-10a507213a29
golang.org/x/net v0.17.0
golang.org/x/oauth2 v0.6.0
golang.org/x/oauth2 v0.7.0
golang.org/x/sync v0.2.0
golang.org/x/sys v0.13.0
golang.org/x/time v0.3.0
google.golang.org/genproto v0.0.0-20221227171554-f9683d7f8bef
google.golang.org/grpc v1.52.3
google.golang.org/protobuf v1.28.1
google.golang.org/genproto/googleapis/rpc v0.0.0-20230526203410-71b5a4ffd15e
google.golang.org/grpc v1.56.3
google.golang.org/protobuf v1.31.0
gopkg.in/square/go-jose.v2 v2.5.1
gotest.tools/v3 v3.0.3
k8s.io/api v0.26.1
Expand All @@ -117,9 +118,9 @@ require (
)

require (
cloud.google.com/go/compute v1.14.0 // indirect
cloud.google.com/go/compute v1.19.1 // indirect
cloud.google.com/go/compute/metadata v0.2.3 // indirect
cloud.google.com/go/iam v0.8.0 // indirect
cloud.google.com/go/iam v0.13.0 // indirect
github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
github.com/Azure/go-autorest/autorest v0.11.28 // indirect
Expand All @@ -144,11 +145,11 @@ require (
github.com/bgentry/speakeasy v0.1.0 // indirect
github.com/boltdb/bolt v1.3.1 // indirect
github.com/cenkalti/backoff/v3 v3.0.0 // indirect
github.com/census-instrumentation/opencensus-proto v0.2.1 // indirect
github.com/cespare/xxhash/v2 v2.1.2 // indirect
github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible // indirect
github.com/circonus-labs/circonusllhist v0.1.3 // indirect
github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1 // indirect
github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4 // indirect
github.com/coreos/etcd v3.3.27+incompatible // indirect
github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf // indirect
github.com/coreos/pkg v0.0.0-20220810130054-c7d1c02cb6cf // indirect
Expand All @@ -158,7 +159,7 @@ require (
github.com/digitalocean/godo v1.10.0 // indirect
github.com/dimchansky/utfbom v1.1.1 // indirect
github.com/emicklei/go-restful/v3 v3.9.0 // indirect
github.com/envoyproxy/protoc-gen-validate v0.1.0 // indirect
github.com/envoyproxy/protoc-gen-validate v1.0.1 // indirect
github.com/go-logr/logr v1.2.4 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-ole/go-ole v1.2.6 // indirect
Expand All @@ -174,16 +175,16 @@ require (
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v4 v4.2.0 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.2 // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/golang/snappy v0.0.4 // indirect
github.com/google/btree v1.0.1 // indirect
github.com/google/gnostic v0.5.7-v3refs // indirect
github.com/google/go-querystring v1.0.0 // indirect
github.com/google/uuid v1.3.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.1 // indirect
github.com/googleapis/gax-go/v2 v2.7.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.3 // indirect
github.com/googleapis/gax-go/v2 v2.7.1 // indirect
github.com/gophercloud/gophercloud v0.3.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect
github.com/hashicorp/go-msgpack v0.5.5 // indirect
github.com/hashicorp/go-msgpack/v2 v2.0.0 // indirect
Expand Down Expand Up @@ -225,7 +226,7 @@ require (
github.com/posener/complete v1.2.3 // indirect
github.com/power-devops/perfstat v0.0.0-20220216144756-c35f1ee13d7c // indirect
github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 // indirect
github.com/prometheus/client_model v0.3.0 // indirect
github.com/prometheus/client_model v0.4.0 // indirect
github.com/prometheus/common v0.39.0 // indirect
github.com/prometheus/procfs v0.8.0 // indirect
github.com/renier/xmlrpc v0.0.0-20170708154548-ce4a1a486c03 // indirect
Expand All @@ -252,12 +253,14 @@ require (
go.opentelemetry.io/otel/trace v1.16.0 // indirect
go.uber.org/atomic v1.9.0 // indirect
golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 // indirect
golang.org/x/mod v0.8.0 // indirect
golang.org/x/mod v0.10.0 // indirect
golang.org/x/term v0.13.0 // indirect
golang.org/x/text v0.13.0 // indirect
golang.org/x/tools v0.6.0 // indirect
google.golang.org/api v0.109.0 // indirect
golang.org/x/tools v0.8.0 // indirect
google.golang.org/api v0.114.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20230526203410-71b5a4ffd15e // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20230526203410-71b5a4ffd15e // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/resty.v1 v1.12.0 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
Expand Down
Loading

0 comments on commit 343688d

Please sign in to comment.