rollandf / sriov-network-operator

63%

master: 63%

LAST BUILD ON BRANCH ignition-cve

branch: ignition-cve

CHANGE BRANCH

x

Reset

Sync Branches

• ignition-cve
• CVE-2021-20206
• CVE-2022-1996
• CVE-2022-3064
• add-u
• add-u-br
• baseimage
• baseimage25.10
• bridgesecure
• ci-base-branch
• ci-pr-branch
• ci-pr-branch-back
• ci-pr-title
• daemonresult
• delete
• dependabot/docker/golang-1.25
• dependabot/github_actions/actions/checkout-5
• dependabot/github_actions/actions/checkout-6
• dependabot/github_actions/actions/labeler-6
• dependabot/github_actions/actions/setup-go-6
• dependabot/github_actions/actions/upload-artifact-5
• dependabot/github_actions/azure/setup-helm-4.3.1
• dependabot/github_actions/coverallsapp/github-action-2.3.6
• dependabot/github_actions/coverallsapp/github-action-2.3.7
• dependabot/github_actions/docker/build-push-action-6
• dependabot/github_actions/docker/setup-buildx-action-3
• dependabot/github_actions/github/codeql-action-4
• dependabot/go_modules/general-dependencies-070606913e
• dependabot/go_modules/general-dependencies-35e5ba6828
• dependabot/go_modules/general-dependencies-5b87cf7aa9
• dependabot/go_modules/general-dependencies-8e0f654415
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• disable-plugins-helm
• dockerarg
• dockerargbp
• events
• force
• force-backport
• goconst
• goproxy
• gov-ready
• hook-affinity
• karg-temp
• labeler
• loop
• master
• mtu-ovs
• nvstaging
• oauth
• oauth2
• oauth3
• otherconfigbp261
• ovs-internal
• securebridgeovs
• typo
• updates-26.1.x
• webhookport

Build # 20056180481

Build Type

Pull #24

github

Committed by rollandf

Commit Message

Fix CVE: Remove vulnerable ignition v0.35.0 dep

Replace machine-config-operator imports with local implementations
to eliminate dependency on vulnerable github.com/coreos/ignition v0.35.0.

Created local helper functions in pkg/render/ignition_helpers.go that
use only safe ignition/v2 packages. Added constants to pkg/consts to
avoid importing machine-config-operator constants.

Fixes: https://github.com/advisories/GHSA-hj57-j5cw-2mwp

CVE-2022-1706

Signed-off-by: Fred Rolland <frolland@nvidia.com>

Pull Request Pull Request #24: fix: CVE CVE-2022-1706

Run Details

41 of 62 new or added lines in 3 files covered. (66.13%)

3 existing lines in 1 file now uncovered.

9112 of 14417 relevant lines covered (63.2%)

0.7 hits per line