Skip to content

Commit 175612c

Browse files
ajanikowajanikow
authored
[Feature] Fix Helm & JWT CVE's (#1890)
1 parent f2c30ab commit 175612c

File tree

12 files changed

+71
-71
lines changed

12 files changed

+71
-71
lines changed

‎.golangci.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,8 @@ linters-settings:
183183
pkg: strings
184184
- alias: goHttp
185185
pkg: net/http
186+
- alias: jwt
187+
pkg: github.com/golang-jwt/jwt/v5
186188
gci:
187189
sections:
188190
- standard

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
- (Bugfix) Prevent UpToDate Condition changes during Action processing
66
- (Feature) (Platform) Reorganize Envoy Auth
77
- (Feature) Ensure Group Service Type
8+
- (Maintenance) Fix Helm & JWT CVE's
89

910
## [1.2.48](https://github.com/arangodb/kube-arangodb/tree/1.2.48) (2025-05-08)
1011
- (Maintenance) Extend Documentation

‎go.mod

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,21 @@ replace (
1414
k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.31.8
1515
k8s.io/apimachinery => k8s.io/apimachinery v0.31.8
1616
k8s.io/apiserver => k8s.io/apiserver v0.31.8
17+
k8s.io/cli-runtime => k8s.io/cli-runtime v0.31.8
1718
k8s.io/client-go => k8s.io/client-go v0.31.8
1819
k8s.io/cloud-provider => k8s.io/cloud-provider v0.31.8
1920
k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.31.8
2021
k8s.io/code-generator => ./deps/k8s.io/code-generator
2122
k8s.io/component-base => k8s.io/component-base v0.31.8
23+
k8s.io/kubectl => k8s.io/kubectl v0.31.8
2224
k8s.io/kubernetes => k8s.io/kubernetes v0.31.8
2325
k8s.io/metrics => k8s.io/metrics v0.31.8
2426
)
2527

2628
require (
2729
github.com/arangodb-helper/go-certificates v0.0.0-20180821055445-9fca24fc2680
2830
github.com/arangodb-helper/go-helper v0.4.2
29-
github.com/arangodb/arangosync-client v0.9.0
31+
github.com/arangodb/arangosync-client v0.9.1
3032
github.com/arangodb/go-driver v1.6.6
3133
github.com/arangodb/go-driver/v2 v2.1.3
3234
github.com/arangodb/go-upgrade-rules v0.0.0-20180809110947-031b4774ff21
@@ -38,7 +40,6 @@ require (
3840
github.com/envoyproxy/go-control-plane v0.13.1
3941
github.com/fsnotify/fsnotify v1.7.0
4042
github.com/gin-gonic/gin v1.9.1
41-
github.com/golang-jwt/jwt v3.2.2+incompatible
4243
github.com/golang/protobuf v1.5.4 // indirect
4344
github.com/google/uuid v1.6.0
4445
github.com/jessevdk/go-assets v0.0.0-20160921144138-4f4301a06e15
@@ -64,10 +65,10 @@ require (
6465
google.golang.org/grpc v1.70.0
6566
google.golang.org/protobuf v1.36.5
6667
gopkg.in/yaml.v3 v3.0.1
67-
k8s.io/api v0.31.8
68-
k8s.io/apiextensions-apiserver v0.31.8
69-
k8s.io/apimachinery v0.31.8
70-
k8s.io/client-go v0.31.8
68+
k8s.io/api v0.32.2
69+
k8s.io/apiextensions-apiserver v0.32.2
70+
k8s.io/apimachinery v0.32.2
71+
k8s.io/client-go v0.32.2
7172
k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f
7273
sigs.k8s.io/yaml v1.4.0
7374
)
@@ -78,10 +79,11 @@ require (
7879
github.com/arangodb-managed/integration-apis v0.2.1
7980
github.com/aws/aws-sdk-go v1.55.6
8081
github.com/go-logr/zerologr v1.2.3
82+
github.com/golang-jwt/jwt/v5 v5.2.2
8183
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1
8284
github.com/jedib0t/go-pretty/v6 v6.6.5
8385
google.golang.org/genproto/googleapis/api v0.0.0-20250204164813-702378808489
84-
helm.sh/helm/v3 v3.16.4
86+
helm.sh/helm/v3 v3.17.3
8587
k8s.io/klog/v2 v2.130.1
8688
)
8789

@@ -142,7 +144,6 @@ require (
142144
github.com/gobwas/glob v0.2.3 // indirect
143145
github.com/goccy/go-json v0.10.2 // indirect
144146
github.com/gogo/protobuf v1.3.2 // indirect
145-
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
146147
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
147148
github.com/google/btree v1.0.1 // indirect
148149
github.com/google/gnostic-models v0.6.8 // indirect
@@ -222,10 +223,10 @@ require (
222223
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
223224
gopkg.in/inf.v0 v0.9.1 // indirect
224225
gopkg.in/yaml.v2 v2.4.0 // indirect
225-
k8s.io/apiserver v0.31.8 // indirect
226-
k8s.io/cli-runtime v0.31.8 // indirect
227-
k8s.io/component-base v0.31.8 // indirect
228-
k8s.io/kubectl v0.31.8 // indirect
226+
k8s.io/apiserver v0.32.2 // indirect
227+
k8s.io/cli-runtime v0.32.2 // indirect
228+
k8s.io/component-base v0.32.2 // indirect
229+
k8s.io/kubectl v0.32.2 // indirect
229230
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738 // indirect
230231
oras.land/oras-go v1.2.5 // indirect
231232
sigs.k8s.io/controller-runtime v0.16.3 // indirect

‎go.sum

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -838,6 +838,8 @@ github.com/arangodb-managed/integration-apis v0.2.1 h1:/crCuhBCIIvx+r+RC3cMJ7Mo5
838838
github.com/arangodb-managed/integration-apis v0.2.1/go.mod h1:yMK28s6LsYk7j0NfmuutYRSJI47iCcTTNWXmYGmi1h8=
839839
github.com/arangodb/arangosync-client v0.9.0 h1:XhY+5gGGpl9Gk8Prqmdv0SpK3HydFUXvN2CmTIKUxKI=
840840
github.com/arangodb/arangosync-client v0.9.0/go.mod h1:kU2UaOkv2AeHLAFMEo4Ug3qLbUQVKOuRtkfr6pZqmuk=
841+
github.com/arangodb/arangosync-client v0.9.1 h1:zq5JUjNK51tWKjA0FARouAiI+A8QtwHs0353K+PUo9k=
842+
github.com/arangodb/arangosync-client v0.9.1/go.mod h1:5f4j6DJ95IetZw67Yqy91Ptz2R5xzaVoawV2bHVRuHw=
841843
github.com/arangodb/go-agency-helper v0.4.1 h1:p/lbjz0ludEw30ig/Dv+lueZAIHIsTmXp/HQm5t5F94=
842844
github.com/arangodb/go-agency-helper v0.4.1/go.mod h1:IMzQ1JilLu764DgFQ1qh21jPEzsMohcWQ4334BBxixE=
843845
github.com/arangodb/go-driver v1.2.1/go.mod h1:zdDkJJnCj8DAkfbtIjIXnsTrWIiy6VhP3Vy14p+uQeY=
@@ -2595,6 +2597,8 @@ helm.sh/helm/v3 v3.16.2 h1:Y9v7ry+ubQmi+cb5zw1Llx8OKHU9Hk9NQ/+P+LGBe2o=
25952597
helm.sh/helm/v3 v3.16.2/go.mod h1:SyTXgKBjNqi2NPsHCW5dDAsHqvGIu0kdNYNH9gQaw70=
25962598
helm.sh/helm/v3 v3.16.4 h1:rBn/h9MACw+QlhxQTjpl8Ifx+VTWaYsw3rguGBYBzr0=
25972599
helm.sh/helm/v3 v3.16.4/go.mod h1:k8QPotUt57wWbi90w3LNmg3/MWcLPigVv+0/X4B8BzA=
2600+
helm.sh/helm/v3 v3.17.3 h1:3n5rW3D0ArjFl0p4/oWO8IbY/HKaNNwJtOQFdH2AZHg=
2601+
helm.sh/helm/v3 v3.17.3/go.mod h1:+uJKMH/UiMzZQOALR3XUf3BLIoczI2RKKD6bMhPh4G8=
25982602
honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
25992603
honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
26002604
honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -2639,6 +2643,8 @@ k8s.io/cli-runtime v0.31.1 h1:/ZmKhmZ6hNqDM+yf9s3Y4KEYakNXUn5sod2LWGGwCuk=
26392643
k8s.io/cli-runtime v0.31.1/go.mod h1:pKv1cDIaq7ehWGuXQ+A//1OIF+7DI+xudXtExMCbe9U=
26402644
k8s.io/cli-runtime v0.31.8 h1:58BF5fJFn0rBlz0U3JXQmvyWf1Be3BX6qhCUhO1/4QU=
26412645
k8s.io/cli-runtime v0.31.8/go.mod h1:/44n6BZ3M5DbT+RVma6AzfLfZ8c8v8tq+ATDoeOkas0=
2646+
k8s.io/cli-runtime v0.32.2 h1:aKQR4foh9qeyckKRkNXUccP9moxzffyndZAvr+IXMks=
2647+
k8s.io/cli-runtime v0.32.2/go.mod h1:a/JpeMztz3xDa7GCyyShcwe55p8pbcCVQxvqZnIwXN8=
26422648
k8s.io/client-go v0.31.1 h1:f0ugtWSbWpxHR7sjVpQwuvw9a3ZKLXX0u0itkFXufb0=
26432649
k8s.io/client-go v0.31.1/go.mod h1:sKI8871MJN2OyeqRlmA4W4KM9KBdBUpDLu/43eGemCg=
26442650
k8s.io/client-go v0.31.2 h1:Y2F4dxU5d3AQj+ybwSMqQnpZH9F30//1ObxOKlTI9yc=
@@ -2681,6 +2687,8 @@ k8s.io/kubectl v0.31.1 h1:ih4JQJHxsEggFqDJEHSOdJ69ZxZftgeZvYo7M/cpp24=
26812687
k8s.io/kubectl v0.31.1/go.mod h1:aNuQoR43W6MLAtXQ/Bu4GDmoHlbhHKuyD49lmTC8eJM=
26822688
k8s.io/kubectl v0.31.8 h1:qBSmBBMACJ2fpClRdzh6o5yYzYl4Nt9kIzQBmlBYCRI=
26832689
k8s.io/kubectl v0.31.8/go.mod h1:ZAxEoXDcdJlgmxuJo5zzHmkjWKgicaGErw/9KgaB6Sw=
2690+
k8s.io/kubectl v0.32.2 h1:TAkag6+XfSBgkqK9I7ZvwtF0WVtUAvK8ZqTt+5zi1Us=
2691+
k8s.io/kubectl v0.32.2/go.mod h1:+h/NQFSPxiDZYX/WZaWw9fwYezGLISP0ud8nQKg+3g8=
26842692
k8s.io/metrics v0.31.2 h1:sQhujR9m3HN/Nu/0fTfTscjnswQl0qkQAodEdGBS0N4=
26852693
k8s.io/metrics v0.31.2/go.mod h1:QqqyReApEWO1UEgXOSXiHCQod6yTxYctbAAQBWZkboU=
26862694
k8s.io/metrics v0.31.5 h1:0QQQ20yA3IdXyXC0CXLveRwOXF0ekCuPf6iNKVqXIbw=

‎pkg/api/auth.go

Lines changed: 11 additions & 8 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/api/jwt.go

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/deployment/resources/secrets.go

Lines changed: 4 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ import (
2727
"fmt"
2828
"time"
2929

30-
jg "github.com/golang-jwt/jwt"
30+
jwt "github.com/golang-jwt/jwt/v5"
3131
core "k8s.io/api/core/v1"
3232
"k8s.io/apimachinery/pkg/api/equality"
3333
meta "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -424,7 +424,7 @@ func AppendKeyfileToKeyfolder(ctx context.Context, cachedStatus inspectorInterfa
424424
}
425425

426426
var (
427-
exporterTokenClaims = jg.MapClaims{
427+
exporterTokenClaims = jwt.MapClaims{
428428
token.ClaimISS: token.ClaimISSValue,
429429
"server_id": "exporter",
430430
"allowed_paths": []interface{}{"/_admin/statistics", "/_admin/statistics-description",
@@ -490,18 +490,13 @@ func (r *Resources) ensureExporterTokenSecretCreateRequired(cachedStatus inspect
490490
return true, true, errors.WithStack(err)
491491
}
492492

493-
token, err := jg.Parse(string(data), func(token *jg.Token) (i interface{}, err error) {
494-
return []byte(secret), nil
495-
})
493+
token, err := token.Parse(string(data), []byte(secret))
496494

497495
if err != nil {
498496
return true, true, nil
499497
}
500498

501-
tokenClaims, ok := token.Claims.(jg.MapClaims)
502-
if !ok {
503-
return true, true, nil
504-
}
499+
tokenClaims := jwt.MapClaims(token)
505500

506501
return !equality.Semantic.DeepDerivative(tokenClaims, exporterTokenClaims), true, nil
507502
}

‎pkg/util/token/errors.go

Lines changed: 3 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2024 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2024-2025 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.
@@ -21,26 +21,11 @@
2121
package token
2222

2323
import (
24-
jg "github.com/golang-jwt/jwt"
24+
jwt "github.com/golang-jwt/jwt/v5"
2525

2626
"github.com/arangodb/kube-arangodb/pkg/util/errors"
2727
)
2828

2929
func IsSignatureInvalidError(err error) bool {
30-
return isJQError(err, jg.ErrSignatureInvalid)
31-
}
32-
33-
func isJQError(err, expected error) bool {
34-
if err == nil || expected == nil {
35-
return false
36-
}
37-
38-
var v *jg.ValidationError
39-
if errors.As(err, &v) {
40-
if errors.Is(v.Inner, expected) {
41-
return true
42-
}
43-
}
44-
45-
return false
30+
return errors.Is(err, jwt.ErrSignatureInvalid)
4631
}

‎pkg/util/token/mods.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@ package token
2323
import (
2424
"time"
2525

26-
jg "github.com/golang-jwt/jwt"
26+
jwt "github.com/golang-jwt/jwt/v5"
2727
)
2828

29-
var defaultTokenClaims = jg.MapClaims{
29+
var defaultTokenClaims = jwt.MapClaims{
3030
ClaimISS: ClaimISSValue,
3131
}
3232

‎pkg/util/token/parse.go

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
//
22
// DISCLAIMER
33
//
4-
// Copyright 2024 ArangoDB GmbH, Cologne, Germany
4+
// Copyright 2024-2025 ArangoDB GmbH, Cologne, Germany
55
//
66
// Licensed under the Apache License, Version 2.0 (the "License");
77
// you may not use this file except in compliance with the License.
@@ -21,21 +21,29 @@
2121
package token
2222

2323
import (
24-
jg "github.com/golang-jwt/jwt"
24+
jwt "github.com/golang-jwt/jwt/v5"
2525

2626
"github.com/arangodb/kube-arangodb/pkg/util/errors"
2727
)
2828

29-
func Parse(token string, secret []byte) (Claims, error) {
30-
parsedToken, err := jg.Parse(token, func(token *jg.Token) (i interface{}, err error) {
31-
return secret, nil
32-
})
29+
var NotValidToken = errors.Errorf("Token is not valid")
3330

31+
func Parse(token string, secret []byte) (Claims, error) {
32+
parsedToken, err := jwt.Parse(token,
33+
func(token *jwt.Token) (i interface{}, err error) {
34+
return secret, nil
35+
},
36+
jwt.WithIssuedAt(),
37+
)
3438
if err != nil {
3539
return nil, err
3640
}
3741

38-
tokenClaims, ok := parsedToken.Claims.(jg.MapClaims)
42+
if !parsedToken.Valid {
43+
return nil, NotValidToken
44+
}
45+
46+
tokenClaims, ok := parsedToken.Claims.(jwt.MapClaims)
3947
if !ok {
4048
return nil, errors.Errorf("Invalid token provided")
4149
}
@@ -56,8 +64,5 @@ func ParseWithAny(token string, secrets ...[]byte) (Claims, error) {
5664
}
5765
}
5866

59-
return nil, &jg.ValidationError{
60-
Inner: jg.ErrSignatureInvalid,
61-
Errors: 1,
62-
}
67+
return nil, jwt.ErrSignatureInvalid
6368
}

‎pkg/util/token/token.go

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
package token
2222

2323
import (
24-
jg "github.com/golang-jwt/jwt"
24+
jwt "github.com/golang-jwt/jwt/v5"
2525

2626
"github.com/arangodb/kube-arangodb/pkg/util/errors"
2727
)
@@ -41,7 +41,7 @@ func NewClaims() Claims {
4141
return Claims{}
4242
}
4343

44-
type Claims jg.MapClaims
44+
type Claims jwt.MapClaims
4545

4646
func (t Claims) With(mods ...Mod) Claims {
4747
q := t
@@ -58,7 +58,7 @@ func (t Claims) With(mods ...Mod) Claims {
5858
}
5959

6060
func New(secret []byte, claims map[string]interface{}) (string, error) {
61-
token := jg.NewWithClaims(jg.SigningMethodHS256, jg.MapClaims(claims))
61+
token := jwt.NewWithClaims(jwt.SigningMethodHS256, jwt.MapClaims(claims))
6262

6363
// Sign and get the complete encoded token as a string using the secret
6464
signedToken, err := token.SignedString(secret)

0 commit comments

Comments
 (0)