fix(security): upgrade golang.org/x/oauth2 to v0.27.0 to resolve CVE-2025-22868 #5233
Conversation
PriteshKiri
added
Hacktoberfest
hacktoberfest-accepted
chaoscenter/authentication/go.mod
Outdated
| module github.com/litmuschaos/litmus/chaoscenter/authentication | ||
|
|
||
| go 1.22.0 | ||
| go 1.23.0 |
There was a problem hiding this comment.
Please update it to 1.24.0 along with other 2 more places -
- Dockerfile
- CI build workflow.
There was a problem hiding this comment.
thanks for the review
I'll update and push
There was a problem hiding this comment.
@Jonsy13
Thanks for the review! 🙌
I’ve updated the Go version to 1.24.0 in all three places — go.mod, Dockerfile, and the CI build workflow as suggested.
Kindly review the latest changes and let me know if there are any other updates required. 😊
UJESH2K
force-pushed
the
fix/oauth2-vulnerability
branch
4 times, most recently
from
f7b0f17 to
ccc4ccf
Compare
|
The Trivy scan is currently failing on this PR due to a vulnerability in github.com/golang-jwt/jwt (CVE-2025-30204). |
…2025-22868 Signed-off-by: UJESH2K <[email protected]> Signed-off-by: UJESH KUMAR YADAV <[email protected]>
UJESH2K
force-pushed
the
fix/oauth2-vulnerability
branch
from
6f66aa3 to
ff10a26
Compare
…flow Signed-off-by: UJESH2K <[email protected]> Signed-off-by: UJESH KUMAR YADAV <[email protected]>
UJESH2K
force-pushed
the
fix/oauth2-vulnerability
branch
from
ff10a26 to
af3ffcc
Compare
Signed-off-by: UJESH2K <[email protected]> Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
UJESH2K
force-pushed
the
fix/oauth2-vulnerability
branch
from
af3ffcc to
a8c2cb1
Compare
|
Please update this branch with main & resolve conflicts |
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
|
please review the PRs they are up to date now ! |
| golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= | ||
| golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs= | ||
| golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI= | ||
| golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M= |
There was a problem hiding this comment.
This should be done from go.mod not from here directly.First update go.mod & then run go mod tidy. Please fix.
Signed-off-by: UJESH KUMAR YADAV <[email protected]>
3 participants
Fixes #5232
Summary
Upgrades
golang.org/x/oauth2from v0.21.0 → v0.27.0 to patch CVE-2025-22868 (DoS vulnerability).Validation
✅ go build ./...
✅ go test ./...
✅ govulncheck shows no oauth2 vulnerability
No authentication or token flow regressions observed.