CVE fixes of High priority

[ChristianZaccaria]

Issue link

Jira: https://issues.redhat.com/browse/RHOAIENG-5504

What changes have been made

Upgraded dependencies to fix a number of High CVEs.

Verification steps

e2e tests passing is sufficient.

Checks

• I've made sure the tests are passing.
• Testing Strategy
  • Unit tests
  • Manual tests
  • Testing is not required for this change

[KPostOffice]

One tiny comment

[KPostOffice]

Can this be change to v5.5.5?

[ChristianZaccaria]

It is a strange one, I tried doing that but go doesn't like it. I.e.,

• With v5.5.4, a go mod tidy successfully replaces the v4 module in go.mod and go.sum.
• With v5.5.5 a go mod tidy fails.

I even performed a git reset --hard to previous commit to ensure a fresh state to test getting and replacing the module for v5.5.5, but still failed on go mod tidy.

[christianzaccaria@thinkpad codeflare-operator]$ go get github.com/jackc/pgx/v5@v5.5.4
go: github.com/jackc/pgx/v5@v5.5.4 used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)
[christianzaccaria@thinkpad codeflare-operator]$ go mod tidy
[christianzaccaria@thinkpad codeflare-operator]$ go get github.com/jackc/pgx/v5@v5.5.5
go: github.com/jackc/pgx/v5@v5.5.5 used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)
[christianzaccaria@thinkpad codeflare-operator]$ go mod tidy
go: finding module for package github.com/jackc/pgx/v5/pgxpool
go: finding module for package github.com/jackc/pgx/v5/pgconn
go: finding module for package github.com/jackc/pgx/v5/pgtype
go: finding module for package github.com/jackc/pgx/v5
go: found github.com/jackc/pgx/v5 in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgconn in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgtype in github.com/jackc/pgx/v5 v5.5.5
go: found github.com/jackc/pgx/v5/pgxpool in github.com/jackc/pgx/v5 v5.5.5
go: github.com/jackc/pgx/v5@v5.5.5 used for two different module paths (github.com/jackc/pgx/v4 and github.com/jackc/pgx/v5)

[astefanutti]

Out-of-curiosity, where do these transitive dependencies come from? Could they be upgraded by upgrading k8s version / controller-runtime?

[ChristianZaccaria]

Out-of-curiosity, where do these transitive dependencies come from? Could they be upgraded by upgrading k8s version / controller-runtime?

@astefanutti For pgx module, the transitive dependencies come from ocm-sdk-go. Their main branch and also latest tag make use of an older version of pgx module.

The other module otelhttp does come from k8s.io/component-base and k8s.io/apiextensions-apiserver. I'll see if I can upgrade these ones instead, thanks!

Snyk - pgx CVE
Snyk - otelhttp CVE

[ChristianZaccaria]

@astefanutti upgrading k8s modules causes some issues in tests. Should I drop that commit for now?

[sutaakar]

The test issues could be resolved by upgrading codeflare-common , however upgraded version use Go 1.21, so it can't be used until we upgrade CFO to 1.21?

[ChristianZaccaria]

@sutaakar Thank you, that could work. I see that the latest go ubi8 image is 1.20. Do you think dropping the latest commit here for now is okay?

[sutaakar]

it is fine for me

[Bobbins228]

When trying to create an image I got this error:

/home/mark/codeflare-operator/bin/controller-gen rbac:roleName=manager-role webhook paths="./..."
Error: err: exit status 1: stderr: go: updates to go.mod needed; to update it:
	go mod tidy
run `controller-gen rbac:roleName=manager-role webhook paths=./... -w` to see all available markers, or `controller-gen rbac:roleName=manager-role webhook paths=./... -h` for usage
make: *** [Makefile:131: manifests] Error 1

[Fiona-Waters]

I tried to create an image with make image-build -e IMG=quay.io/rh_ee_fwaters/codeflare-operator:cve and it worked successfully. I am running go1.20.
@Bobbins228 is using go1.22.1 so this could be what is causing the issue.

[astefanutti]

@ChristianZaccaria could you give this a rebase please?

[ChristianZaccaria]

@ChristianZaccaria could you give this a rebase please?

Rebased, thank you!

[astefanutti]

/lgtm

[dimakis]

/approve

[astefanutti]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: astefanutti, dimakis

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [astefanutti]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment