rollandf / sriov-network-operator / 20056180481

63%

master: 63%

Build Type

Pull #24

github

Committed by rollandf

Commit Message

Fix CVE: Remove vulnerable ignition v0.35.0 dep

Replace machine-config-operator imports with local implementations
to eliminate dependency on vulnerable github.com/coreos/ignition v0.35.0.

Created local helper functions in pkg/render/ignition_helpers.go that
use only safe ignition/v2 packages. Added constants to pkg/consts to
avoid importing machine-config-operator constants.

Fixes: https://github.com/advisories/GHSA-hj57-j5cw-2mwp

CVE-2022-1706

Signed-off-by: Fred Rolland <frolland@nvidia.com>

Pull Request Pull Request #24: fix: CVE CVE-2022-1706

Run Details

41 of 62 new or added lines in 3 files covered. (66.13%)

3 existing lines in 1 file now uncovered.

9112 of 14417 relevant lines covered (63.2%)

0.7 hits per line