Skip to content

x/vuln: false positive call stack for GO-2023-2402 in Kubernetes #64834

@aojea

Description

@aojea
$ govulncheck ./...
Scanning your code and 2016 packages across 204 dependent modules for known vulnerabilities...

Vulnerability #1: GO-2023-2402
    Man-in-the-middle attacker can compromise integrity of secure channel in
    golang.org/x/crypto
  More info: https://pkg.go.dev/vuln/GO-2023-2402
  Module: golang.org/x/crypto
    Found in: golang.org/x/crypto@v0.14.0
    Fixed in: golang.org/x/crypto@v0.17.0
    Example traces found:
      #1: test/e2e/framework/ssh/ssh.go:316:33: ssh.runSSHCommandViaBastion calls ssh.Client.Dial
      #2: test/e2e/framework/ssh/ssh.go:329:35: ssh.runSSHCommandViaBastion calls ssh.Client.NewSession
      #3: test/e2e/framework/ssh/ssh.go:301:32: ssh.runSSHCommandViaBastion calls ssh.Dial
      #4: test/e2e/framework/ssh/ssh.go:326:25: ssh.runSSHCommandViaBastion calls ssh.NewClient
      #5: test/e2e/framework/ssh/ssh.go:322:44: ssh.runSSHCommandViaBastion calls ssh.NewClientConn
      #6: test/e2e/framework/ssh/ssh.go:333:2: ssh.runSSHCommandViaBastion calls ssh.Session.Close
      #7: test/e2e/framework/ssh/ssh.go:339:22: ssh.runSSHCommandViaBastion calls ssh.Session.Run
      #8: test/e2e/framework/ssh/ssh.go:320:2: ssh.runSSHCommandViaBastion calls ssh.channel.Close
      #9: test/utils/harness/harness.go:54:14: harness.Harness.Close calls ssh.stdin, which calls ssh.channel.CloseWrite
      #10: cmd/kubeadm/app/preflight/checks.go:339:18: preflight.FileContentCheck.Check calls io.Copy, which eventually calls ssh.channel.Read
      #11: cmd/kubeadm/app/preflight/checks.go:544:13: preflight.SystemVerificationCheck.Check calls bufio.Writer.Flush, which calls ssh.channel.Write
      #12: cmd/kubeadm/app/preflight/checks.go:339:18: preflight.FileContentCheck.Check calls io.Copy, which eventually calls ssh.extChannel.Read

Your code is affected by 1 vulnerability from 1 module.

Share feedback at https://go.dev/s/govulncheck-feedback.

There are doubts about the next three traces found

calls io.Copy, which eventually calls ssh.channel.Read
calls bufio.Writer.Flush, which calls ssh.channel.Write
calls io.Copy, which eventually calls ssh.extChannel.Read

@neolit123 @dims

xref: kubernetes/kubernetes#122424

Metadata

Metadata

Assignees

Labels

NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.vulncheck or vulndbIssues for the x/vuln or x/vulndb repo

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions