New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

go.mod update for CVE-2024-45337 #411

Merged

saikat-royc merged 1 commit into GoogleCloudPlatform:main from saikat-royc:cve-fix

Dec 13, 2024

Collaborator

saikat-royc commented Dec 13, 2024 •

edited

Loading

generated by
go mod vendor
go mod tidy

smoke test:

build and push the container images to the registry

PROJECT=<my-gcp-project> make build-image-and-push-multi-arch BUILD_GCSFUSE_FROM_SOURCE=false REGISTRY=<gcr.io/my-gcp-project> STAGINGVERSION=v1

Run scan for images gcs-fuse-csi-driver-metadata-prefetch, gcs-fuse-csi-driver, gcs-fuse-csi-driver-webhook

gcloud artifacts docker images scan <container image uri> --remote --experimental-package-types=GO | yq '.response.scan' | xargs -I {} gcloud artifacts docker images list-vulnerabilities {} | yq '.[] | select(.packageIssue.[].fixAvailable == "true")'

Note: gcs-fuse-csi-driver-sidecar-mounter still reports the CVE since the fix is required in gcsfuse binary


          go.mod update for CVE-2024-45337

a047877

saikat-royc requested a review from tyuchn

December 13, 2024 21:09

Collaborator

tyuchn commented Dec 13, 2024

/lgtm
/approve

saikat-royc merged commit 909db59 into GoogleCloudPlatform:main

8 checks passed

saikat-royc mentioned this pull request

go.mod update for CVE-2024-45337 #412

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet