batchrelease controller #9

veophi · 2022-02-23T09:18:55Z

Signed-off-by: veophi vec.g.sun@gmail.com

add batchRelease controller
add e2e test for batchRelease controller

sonatype-lift · 2022-02-23T09:28:47Z

pkg/util/workloads_utils.go

+		DisableMethods: true,
+		SpewKeys:       true,
+	}
+	printer.Fprintf(hasher, "%#v", objectToWrite)


G104: Errors unhandled.
(at-me in a reply with help or ignore)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

sonatype-lift · 2022-02-23T09:28:48Z

test/images/image_utils.go

+		return registry
+	}
+
+	fileContent, err := ioutil.ReadFile(repoList)


G304: Potential file inclusion via variable
(at-me in a reply with help or ignore)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

sonatype-lift · 2022-02-23T09:28:49Z

test/images/image_utils.go

+			break
+		}
+
+		return "", fmt.Errorf("Registry: %s is missing in test/utils/image/manifest.go, please add the registry, otherwise the test will fail on air-gapped clusters", registryAndUser)


ST1005: error strings should not be capitalized
(at-me in a reply with help or ignore)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

furykerry · 2022-03-03T08:35:08Z

controllers/batchrelease/batchrelease_event_handler.go

+		observeScaleEventDone(newAccessor, oldAccessor) ||
+		observeReplicasChanged(newAccessor, oldAccessor) {
+
+		workloadNsn := types.NamespacedName{


what the postfix Nsn means ?

furykerry · 2022-03-03T08:45:24Z

controllers/batchrelease/batchrelease_event_handler.go

+			Name:      newAccessor.Metadata.Name,
+		}
+
+		brNsn, err := w.getBatchRelease(workloadNsn, gvk, newAccessor.Metadata.Annotations[util.BatchReleaseControlAnnotation])


Can we avoid check workload without related rollout annotation, so as to avoid unnecessary rollout listing? We can patch the workload with related rollout annotation in the rollout create event and workload create event

Mark, I will improve this logic in the future.

furykerry · 2022-03-03T08:50:20Z

controllers/batchrelease/batchrelease_controller.go

+	}()
+
+	// remove the release finalizer if it needs
+	if !release.DeletionTimestamp.IsZero() &&


we cannot remove the finalizer before we actually cleanup the underlying workload, otherwise if the controller crash after this function, the cleanup work will not be done anymore

I have considered whether the underlying resources have been cleaned up. If the controller crash before cleaning up, it will retry to clean up when it is resumed.

controllers/batchrelease/batchrelease_plan_executor.go

controllers/batchrelease/workloads/cloneset_control_plan.go

furykerry · 2022-03-03T13:01:52Z

controllers/batchrelease/workloads/cloneset_control_plan.go

+		return false, nil
+	}
+
+	if canaryGoal > canaryReplicas || stableGoal < stableReplicas || canaryReadyReplicas+int32(maxUnavailable) < canaryGoal || (canaryGoal > 0 && canaryReadyReplicas == 0) {


plz wrap de if clause around || , so that the code can be more readable

FillZpp · 2022-02-28T11:22:52Z

controllers/batchrelease/batchrelease_plan_executor.go

+
+func (r *Executor) executeBatchReleasePlan(workloadController workloads2.WorkloadController) (reconcile.Result, *v1alpha1.BatchReleaseStatus) {
+	status := r.releaseStatus
+	retryDuration := reconcile.Result{}


s/retryDuration/result/

FillZpp · 2022-03-07T06:39:09Z

controllers/batchrelease/batchrelease_controller.go

+		HasTerminatingCondition(release.Status) &&
+		controllerutil.ContainsFinalizer(release, ReleaseFinalizer) {
+		finalizers := sets.NewString(release.Finalizers...).Delete(ReleaseFinalizer).List()
+		err = util.PatchFinalizer(r.Client, release, finalizers)


Note that patch in this way that may cause overwrite from each other.

FillZpp · 2022-03-07T06:39:38Z

controllers/batchrelease/batchrelease_controller.go

+	// add the release finalizer if it needs
+	if !controllerutil.ContainsFinalizer(release, ReleaseFinalizer) {
+		finalizers := append(release.Finalizers, ReleaseFinalizer)
+		err = util.PatchFinalizer(r.Client, release, finalizers)


Note that patch in this way that may cause overwrite from each other.

FillZpp · 2022-03-07T06:40:02Z

controllers/batchrelease/batchrelease_event_handler.go

+import (
+	"context"
+	"encoding/json"
+	"github.com/openkruise/rollouts/controllers/batchrelease/workloads"


Please sort the imports.

sonatype-lift · 2022-03-09T07:53:25Z

go.mod

-	k8s.io/client-go v0.20.2
-	sigs.k8s.io/controller-runtime v0.8.3
+	github.com/davecgh/go-spew v1.1.1
+	github.com/onsi/ginkgo v1.16.5


Critical OSS Vulnerability:

pkg:golang/github.com/onsi/ginkgo@1.16.5

5 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/golang.org/x/net@0.0.0-20180906233101-161cd47e91fd

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with `help` or `ignore`)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

sonatype-lift · 2022-03-09T07:53:26Z

go.mod

-	sigs.k8s.io/controller-runtime v0.8.3
+	github.com/davecgh/go-spew v1.1.1
+	github.com/onsi/ginkgo v1.16.5
+	github.com/onsi/gomega v1.17.0


Critical OSS Vulnerability:

pkg:golang/github.com/onsi/gomega@1.17.0

5 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/golang.org/x/net@0.0.0-20180906233101-161cd47e91fd

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with `help` or `ignore`)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

sonatype-lift · 2022-03-09T07:53:28Z

go.mod

+	github.com/davecgh/go-spew v1.1.1
+	github.com/onsi/ginkgo v1.16.5
+	github.com/onsi/gomega v1.17.0
+	github.com/openkruise/kruise-api v1.0.0


Critical OSS Vulnerability:

pkg:golang/github.com/openkruise/kruise-api@1.0.0

16 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 5 dependencies

Components

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/github.com/dgrijalva/jwt-go@3.2.0

CRITICAL Vulnerabilities (1)

[CVE-2020-26160] jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrict...

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/golang.org/x/net@0.0.0-20180906233101-161cd47e91fd

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/net@0.0.0-20180724234803-3673e40ba225

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/net@0.0.0-20180826012351-8a410e7b638d

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with `help` or `ignore`)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

sonatype-lift · 2022-03-09T07:53:29Z

go.mod

+	github.com/openkruise/kruise-api v1.0.0
+	gopkg.in/yaml.v2 v2.4.0
+	k8s.io/api v0.22.5
+	k8s.io/apiextensions-apiserver v0.22.5


Critical OSS Vulnerability:

pkg:golang/k8s.io/api@0.22.5

20 Critical, 5 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 11 dependencies

Components

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/github.com/gogo/protobuf@1.1.1

CRITICAL Vulnerabilities (1)

[CVE-2021-3121] An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarsha...

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS Score: 9.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

pkg:golang/github.com/gogo/protobuf@1.2.1

CRITICAL Vulnerabilities (1)

[CVE-2021-3121] An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarsha...

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS Score: 9.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

pkg:golang/golang.org/x/crypto@0.0.0-20181029021203-45a5f77698d3

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/github.com/dgrijalva/jwt-go@3.2.0

CRITICAL Vulnerabilities (1)

[CVE-2020-26160] jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrict...

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/golang.org/x/net@0.0.0-20180906233101-161cd47e91fd

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/net@0.0.0-20180724234803-3673e40ba225

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/github.com/coreos/etcd@3.3.13

CRITICAL Vulnerabilities (1)

[CVE-2020-15114] In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP prox...

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

CVSS Score: 7.7

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

SEVERE Vulnerabilities (2)

CVE-2020-15136

[CVE-2020-15136] In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only ap...

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

CVSS Score: 6.5

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

CVE-2020-15115

[CVE-2020-15115] etcd before versions 3.3.23 and 3.4.10 does not perform any password length vali...

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

CVSS Score: 5.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

pkg:golang/golang.org/x/net@0.0.0-20180826012351-8a410e7b638d

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/crypto@0.0.0-20180904163835-0709b304e793

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/github.com/gogo/protobuf@1.3.1

CRITICAL Vulnerabilities (1)

[CVE-2021-3121] An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarsha...

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS Score: 9.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with `help` or `ignore`)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

sonatype-lift · 2022-03-09T07:53:31Z

go.mod

+	gopkg.in/yaml.v2 v2.4.0
+	k8s.io/api v0.22.5
+	k8s.io/apiextensions-apiserver v0.22.5
+	k8s.io/apimachinery v0.22.5


Critical OSS Vulnerability:

pkg:golang/k8s.io/apimachinery@0.22.5

15 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 4 dependencies

Components

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/golang.org/x/net@0.0.0-20180906233101-161cd47e91fd

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/net@0.0.0-20180724234803-3673e40ba225

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/net@0.0.0-20180826012351-8a410e7b638d

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with `help` or `ignore`)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

sonatype-lift · 2022-03-09T07:53:32Z

go.mod

+	k8s.io/api v0.22.5
+	k8s.io/apiextensions-apiserver v0.22.5
+	k8s.io/apimachinery v0.22.5
+	k8s.io/client-go v0.22.5


Critical OSS Vulnerability:

pkg:golang/k8s.io/client-go@0.22.5

15 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 4 dependencies

Components

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/golang.org/x/net@0.0.0-20180724234803-3673e40ba225

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/net@0.0.0-20180906233101-161cd47e91fd

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/net@0.0.0-20180826012351-8a410e7b638d

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with `help` or `ignore`)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

sonatype-lift · 2022-03-09T07:53:34Z

go.mod

+	k8s.io/client-go v0.22.5
+	k8s.io/klog/v2 v2.9.0
+	k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a
+	sigs.k8s.io/controller-runtime v0.10.3


Critical OSS Vulnerability:

pkg:golang/sigs.k8s.io/controller-runtime@0.10.3

20 Critical, 5 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 11 dependencies

Components

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/github.com/gogo/protobuf@1.1.1

CRITICAL Vulnerabilities (1)

[CVE-2021-3121] An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarsha...

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS Score: 9.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

pkg:golang/github.com/gogo/protobuf@1.2.1

CRITICAL Vulnerabilities (1)

[CVE-2021-3121] An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarsha...

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS Score: 9.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

pkg:golang/golang.org/x/crypto@0.0.0-20181029021203-45a5f77698d3

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/github.com/dgrijalva/jwt-go@3.2.0

CRITICAL Vulnerabilities (1)

[CVE-2020-26160] jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrict...

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/golang.org/x/net@0.0.0-20180906233101-161cd47e91fd

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/net@0.0.0-20180724234803-3673e40ba225

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/github.com/coreos/etcd@3.3.13

CRITICAL Vulnerabilities (1)

[CVE-2020-15114] In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP prox...

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

CVSS Score: 7.7

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

SEVERE Vulnerabilities (2)

CVE-2020-15136

[CVE-2020-15136] In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only ap...

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

CVSS Score: 6.5

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

CVE-2020-15115

[CVE-2020-15115] etcd before versions 3.3.23 and 3.4.10 does not perform any password length vali...

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

CVSS Score: 5.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

pkg:golang/golang.org/x/net@0.0.0-20180826012351-8a410e7b638d

CRITICAL Vulnerabilities (5)

CVE-2018-17143

[CVE-2018-17143] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17848

[CVE-2018-17848] Data Handling

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17847

[CVE-2018-17847] Improper Input Validation

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <svg><template><desc><t><svg></template>, leading to a "panic: runtime error" (index out of range) in (*nodeStack).pop in node.go, called from (*parser).clearActiveFormattingElements, during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17142

[CVE-2018-17142] Improper Input Validation

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2018-17846

[CVE-2018-17846] Resource Management Errors

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <table><math><select><mi><select></table>, leading to an infinite loop during an html.Parse call because inSelectIM and inSelectInTableIM do not comply with a specification.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

pkg:golang/golang.org/x/crypto@0.0.0-20180904163835-0709b304e793

SEVERE Vulnerabilities (1)

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

pkg:golang/github.com/gogo/protobuf@1.3.1

CRITICAL Vulnerabilities (1)

[CVE-2021-3121] An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarsha...

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

CVSS Score: 9.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with `help` or `ignore`)

I've recorded this as ignored for this pull request. If you change your mind, just comment @sonatype-lift unignore.

furykerry

/lgtm

Signed-off-by: veophi <vec.g.sun@gmail.com>

FillZpp

/lgtm

kruise-bot · 2022-03-10T06:13:37Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FillZpp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [FillZpp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kruise-bot requested review from furykerry and zmberg February 23, 2022 09:18

kruise-bot added the size/XXL label Feb 23, 2022

sonatype-lift bot reviewed Feb 23, 2022

View reviewed changes

veophi force-pushed the batchrelease-controller branch from 178d21d to 235024a Compare February 23, 2022 11:14

veophi requested a review from FillZpp February 23, 2022 11:16

veophi force-pushed the batchrelease-controller branch 2 times, most recently from 30d4efa to 76cf301 Compare February 23, 2022 11:23

furykerry reviewed Mar 3, 2022

View reviewed changes

FillZpp reviewed Mar 8, 2022

View reviewed changes

sonatype-lift bot reviewed Mar 9, 2022

View reviewed changes

furykerry reviewed Mar 10, 2022

View reviewed changes

kruise-bot assigned furykerry Mar 10, 2022

kruise-bot added the lgtm label Mar 10, 2022

veophi added 2 commits March 10, 2022 14:07

add batchrelease controller and test

1be5d05

Signed-off-by: veophi <vec.g.sun@gmail.com>

improve batchrelease controller

862ff6f

Signed-off-by: veophi <vec.g.sun@gmail.com>

veophi force-pushed the batchrelease-controller branch from 7c9a251 to 862ff6f Compare March 10, 2022 06:08

kruise-bot removed the lgtm label Mar 10, 2022

FillZpp approved these changes Mar 10, 2022

View reviewed changes

kruise-bot assigned FillZpp Mar 10, 2022

kruise-bot added the lgtm label Mar 10, 2022

kruise-bot added the approved label Mar 10, 2022

kruise-bot merged commit 7cc32dc into openkruise:master Mar 10, 2022

batchrelease controller #9

batchrelease controller #9

Conversation

veophi commented Feb 23, 2022

sonatype-lift bot Feb 23, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonatype-lift bot Feb 23, 2022

Choose a reason for hiding this comment

sonatype-lift bot Feb 23, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonatype-lift bot Feb 23, 2022

Choose a reason for hiding this comment

sonatype-lift bot Feb 23, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonatype-lift bot Feb 23, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

veophi Mar 9, 2022 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonatype-lift bot Mar 9, 2022

Choose a reason for hiding this comment

pkg:golang/github.com/onsi/ginkgo@1.16.5

[CVE-2019-11840] Use of Insufficiently Random Values

[CVE-2018-17143] Improper Input Validation

[CVE-2018-17848] Data Handling

[CVE-2018-17847] Improper Input Validation

[CVE-2018-17142] Improper Input Validation

[CVE-2018-17846] Resource Management Errors

Choose a reason for hiding this comment

sonatype-lift bot Mar 9, 2022

Choose a reason for hiding this comment

sonatype-lift bot Mar 9, 2022

Choose a reason for hiding this comment

pkg:golang/github.com/onsi/gomega@1.17.0

[CVE-2019-11840] Use of Insufficiently Random Values

[CVE-2018-17143] Improper Input Validation

[CVE-2018-17848] Data Handling

[CVE-2018-17847] Improper Input Validation

[CVE-2018-17142] Improper Input Validation

[CVE-2018-17846] Resource Management Errors

Choose a reason for hiding this comment

sonatype-lift bot Mar 9, 2022

Choose a reason for hiding this comment

sonatype-lift bot Mar 9, 2022

Choose a reason for hiding this comment

pkg:golang/github.com/openkruise/kruise-api@1.0.0

[CVE-2019-11840] Use of Insufficiently Random Values

[CVE-2020-26160] jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrict...

[CVE-2018-17143] Improper Input Validation

[CVE-2018-17848] Data Handling

[CVE-2018-17847] Improper Input Validation

[CVE-2018-17142] Improper Input Validation

[CVE-2018-17846] Resource Management Errors

[CVE-2018-17143] Improper Input Validation

[CVE-2018-17848] Data Handling

[CVE-2018-17847] Improper Input Validation

[CVE-2018-17142] Improper Input Validation

[CVE-2018-17846] Resource Management Errors

[CVE-2018-17143] Improper Input Validation

[CVE-2018-17848] Data Handling

[CVE-2018-17847] Improper Input Validation

[CVE-2018-17142] Improper Input Validation

[CVE-2018-17846] Resource Management Errors

Choose a reason for hiding this comment

sonatype-lift bot Mar 9, 2022

veophi Mar 9, 2022 •

edited

Loading