Bump gRPC and containerd for September CVEs - #278
Bump gRPC and containerd for September CVEs#278ai-collaboration-app[bot] wants to merge 2 commits into
Conversation
|
CI on this branch is red for a pre-existing reason that has nothing to do with this diff, and #280 is the fix. Run 34334224116 fails in the first step on both architectures: The prebuild images are Debian 11 bullseye, now EOL, so This is not caused by the grpc bump. #277 failed identically on 2026-09-08, a day before this branch existed, and the last green CI in the repository was 2026-09-07T09:35Z. #280 removes the apt dependency. Merge #280 first, then this branch needs a rebase to pick it up and produce a green run with a scanned image. Meanwhile, verified locally against the published digest
|
|
Validated: this bump takes the image to Because CI on this branch cannot run until #280 lands, I validated the combined tree instead — #280's commit plus this commit, as branch Evaluator, identical on both architectures:
For contrast, #280 alone — the same tree without this commit — reports All 39 rows the scan attributes to this repository are now accounted for: 37 base-image rows cleared by the rebuild in #280's run at exactly the fixed versions, and the 2 grpc rows cleared here. The validation branch exists only to carry this evidence and can be deleted once this PR is rebased onto #280 and produces its own green run. |
|
Administrative correction: the updatecli bot closed #277 and reopened the same change as #279 ( |
|
Independent CVE review of The change itself checks out: grpc The gap is evidence on this head. This PR cannot go green until #280 lands, and the validation above came from the separate combined branch Separately, and needing a human decision today: the reviewer judged that letting Human review and merge remain mandatory. |
The dev chart scan 34330594840 reports CVE-2026-84445 (HIGH, both scanners) against google.golang.org/grpc v1.83.1 in quay.io/stackstate/stackstate-k8s-process-agent:d1ca2bd2. Note the direction: v1.83.1 is what the previous bump moved this repository up to for CVE-2026-84304, and v1.83.1 is now itself affected, so this is a follow-on rather than a repeat. OSV confirms the scanner lead: GHSA-2v4p-qf9q-27wj has ranges introduced 0 / fixed 1.82.2 and introduced 1.83.0 / fixed 1.83.2, so v1.83.2 is the fix on the line this repository is already on. Neither v1.83.2 nor the x/net v0.58.0 it requires has any OSV entry. golang.org/x/net moves v0.57.0 -> v0.58.0 because grpc v1.83.2's own go.mod requires it; nothing else in the graph changed. The advisory is scoped to gRPC-Go xDS servers crashing on requests missing :authority and Host headers. No google.golang.org/grpc/xds package is linked here - 66 grpc packages are reachable from ./cmd/... and none of them is under xds - so the crash path is not present. It is bumped anyway because a compatible patch release exists, which is cheaper and more durable than a suppression. Validation: go mod verify passes; go build and go test with the release tag set (kubelet kubeapiserver linux cri containerd linux_bpf) leave exactly the two failures a bare checkout already produces on master, undefined runtime.Tracer and runtime.RuntimeSecurity in the datadog-agent upstream eBPF compile assets that the CI prebuild step generates. config, model, pkg/kube, pkg/pods and test-server pass. scripts/verify-openpgp-absent.sh still reports openpgp absent from 1886 packages. The other 38 rows the same scan attributes to this repository are base-image RPMs, not source work. BCI.dockerfile pins no package versions, and the SLE_BCI channel today resolves exactly the fixed version for every one of them, so they clear on the rebuild this commit triggers.
Scan 34489623699 attempt 1 adds the CRI ExecSync goroutine leak to this repository's findings. Upstream GHSA-7jxh-36q5-gcqv confirms v1.7.35 fixes the existing v1.7 line. Only containerd changes; the separately versioned API module remains v1.8.0. The release dependency graph does not include containerd/pkg/cri, but a compatible patch avoids carrying another suppression. Rebased the preceding gRPC fix onto master c028f24, which includes both reviewed prebuild fixes from #280. Keep #281's unrelated checksum cleanup separate. The GO-2026-5932 exception is unchanged and remains a human decision on cve-reporter#27. Validation: go mod verify; release-tag dependency resolution and OpenPGP absence guard (1886 packages); git diff --check. Skip automatic PR CI because that event publishes images. Dispatch ci.yml on this exact branch head for dual-architecture build, test, smoke and scanners with publication skipped, as required for this task. Tracking: StackVista/cve-reporter#69
3e4740d to
c484046
Compare
ai-collaboration-app
Bot
changed the title
1 participant
Updates gRPC to v1.83.2 (with its required x/net v0.58.0) and containerd to v1.7.35 for CVE-2026-84445 and CVE-2026-53495. The existing candidate is rebased onto master c028f24, including merged #280. No exception or VEX change is included.
Validation on actual head
c4840469c675351ab1075f8a8469027828635e51: module verification, release dependency/OpenPGP guard checks (including a negative control), and focused Go tests pass. Dual-architecture build, smoke and Trivy/Grype run is in progress. Automatic PR CI is skipped because it publishes; this branch dispatch skips publication.Review the added containerd patch and final scanner results. Bot #281 is checksum cleanup only and needs a refresh if merged second. GO-2026-5932 remains a human VEX/exception decision on #27, with the existing expiry of 2026-09-10 unchanged.
Tracking: https://github.com/StackVista/cve-reporter/issues/69 — exact scan 34489623699, attempt 1. Candidate validation is not published-image or chart-adoption evidence.