Skip to content

Conversation

@jjngx
Copy link
Contributor

@jjngx jjngx commented Dec 16, 2024

Proposed changes

This PR fixes vulnerability alert for the crypto pkg.

Build the binary:

➜  nginx-prometheus-exporter git:(main) ✗ make
CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X github.com/prometheus/common/version.Version=1.1.0" -o nginx-prometheus-exporter
go: downloading github.com/go-kit/log v0.2.1
go: downloading github.com/alecthomas/kingpin/v2 v2.4.0
go: downloading github.com/nginxinc/nginx-plus-go-client v1.2.0
go: downloading github.com/prometheus/client_golang v1.19.1
go: downloading github.com/prometheus/common v0.54.0
go: downloading github.com/prometheus/exporter-toolkit v0.11.0
go: downloading github.com/go-logfmt/logfmt v0.5.1
go: downloading github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137
go: downloading github.com/xhit/go-str2duration/v2 v2.1.0
go: downloading github.com/prometheus/procfs v0.12.0
go: downloading github.com/cespare/xxhash/v2 v2.2.0
go: downloading google.golang.org/protobuf v1.34.0
go: downloading golang.org/x/crypto v0.22.0
go: downloading golang.org/x/sync v0.5.0
go: downloading github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f
go: downloading golang.org/x/net v0.24.0
go: downloading golang.org/x/oauth2 v0.19.0
go: downloading golang.org/x/sys v0.19.0
go: downloading github.com/jpillora/backoff v1.0.0
go: downloading golang.org/x/text v0.14.0

Run govulncheck

➜  nginx-prometheus-exporter git:(main) ✗ govulncheck -mode binary -show verbose nginx-prometheus-exporter
Scanning your binary for known vulnerabilities...

Fetching vulnerabilities from the database...

Checking the binary against the vulnerabilities...

=== Symbol Results ===

Vulnerability #1: GO-2024-3321
    Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in
    golang.org/x/crypto
  More info: https://pkg.go.dev/vuln/GO-2024-3321
  Module: golang.org/x/crypto
    Found in: golang.org/x/[email protected]
    Fixed in: golang.org/x/[email protected]
    Vulnerable symbols found:
      #1: ssh.ServerConfig.PublicKeyCallback

=== Package Results ===

No other vulnerabilities found.

=== Module Results ===

No other vulnerabilities found.

Your code is affected by 1 vulnerability from 1 module.
This scan found no other vulnerabilities in packages you import or modules you
require.

After the pkg update:

➜  nginx-prometheus-exporter git:(chore/vuln-fix) ✗ make
CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X github.com/prometheus/common/version.Version=1.1.0" -o nginx-prometheus-exporter
➜  nginx-prometheus-exporter git:(chore/vuln-fix) ✗ govulncheck -mode binary -show verbose nginx-prometheus-exporter
Scanning your binary for known vulnerabilities...

Fetching vulnerabilities from the database...

Checking the binary against the vulnerabilities...

No vulnerabilities found.
➜  nginx-prometheus-exporter git:(chore/vuln-fix) ✗ make test
go test ./... -race -shuffle=on -coverprofile=coverage.txt -covermode=atomic
ok  	github.com/nginxinc/nginx-prometheus-exporter	1.986s	coverage: 20.9% of statements
ok  	github.com/nginxinc/nginx-prometheus-exporter/client	2.108s	coverage: 16.0% of statements
ok  	github.com/nginxinc/nginx-prometheus-exporter/collector	2.302s	coverage: 1.2% of statements

Checklist

Before creating a PR, run through this checklist and mark each as complete.

  • I have read the CONTRIBUTING guide
  • I have proven my fix is effective or that my feature works
  • I have checked that all unit tests pass after adding my changes
  • I have ensured the README is up to date
  • I have rebased my branch onto main
  • I will ensure my PR is targeting the main branch and pulling from my branch on my own fork

@jjngx jjngx requested a review from a team as a code owner December 16, 2024 10:05
@github-actions github-actions bot added dependencies Pull requests that update a dependency file chore Pull requests for routine tasks labels Dec 16, 2024
@jjngx jjngx closed this Dec 16, 2024
@jjngx jjngx deleted the chore/vuln-fix branch December 16, 2024 10:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

chore Pull requests for routine tasks dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants