[NEEDS-SCAN] fix: [CI-23226]: remediate vulnerabilities in harnesssecure/gcs (46-CVE reduction)#102
Draft
vinayakharness2026 wants to merge 1 commit into
Conversation
Upgrade Go dependencies and toolchain to eliminate 46 CVEs identified in
harnesssecure/gcs:1.6.10 by baseline Trivy scan (27 HIGH, 16 MEDIUM, 1 LOW,
2 UNKNOWN).
Dependency and toolchain changes (chosen as minimum-safe versions):
- toolchain -> go1.25.12 (fixes 22 stdlib CVEs incl. crypto/x509,
net/http, html/template, mime, net/mail)
- golang.org/x/net v0.48.0 -> v0.55.0
- golang.org/x/crypto v0.46.0 -> v0.52.0
- golang.org/x/text v0.32.0 -> v0.40.0
- golang.org/x/sys v0.40.0 -> v0.46.0
- golang.org/x/oauth2 v0.34.0 -> v0.36.0
- github.com/go-jose/go-jose/v4 v4.1.3 -> v4.1.4
- go.opentelemetry.io/otel v1.40.0 -> v1.44.0
- go.opentelemetry.io/otel/sdk v1.40.0 -> v1.44.0
- google.golang.org/api v0.214.0 -> v0.284.0 (pulls in fixed x/net + x/crypto)
- cloud.google.com/go/storage v1.50.0 -> v1.62.3
Trivy: 47 -> 1 vulns. Only remaining finding is GO-2026-5932 (UNKNOWN
severity in golang.org/x/crypto, no upstream fix available), also present
in the baseline.
vinayakharness2026
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability Remediation: harnesssecure/gcs
Team: ci (Harness CI Platform)
Tickets: CI-23226
Test image:
vinayakharness/gcs-test:gcs-1.6.11--debug(built locally; push to DockerHub was denied by the token's scope — see note below)OnDemand scanner runs (Harness https://harness0.harness.io/):
Connector not found for identifier: [harnessdev])Summary
Baseline Trivy scan of
plugins/gcs:1.6.10(equivalent to the ticket'sharnesssecure/gcs:1.6.10— both are built fromgithub.com/drone-plugins/drone-gcs) reported 47 CVEs (0 Critical / 27 High / 16 Medium / 1 Low / 3 Unknown). After the Go toolchain and dependency bumps in this PR, the rebuilt image contains 1 CVE (0/0/0/0/1 Unknown) — a 46-CVE reduction with zero new HIGH/CRITICAL introduced. The only remaining finding,GO-2026-5932ingolang.org/x/crypto, has no upstream fix published yet and was already present in the baseline. RECOMMENDATION: REVIEW (opened as DRAFT) — the Harness OnDemand scanner was not available due to a pipeline-side connector configuration issue (harnessdevnot found), so external scanner evidence is missing. Trivy evidence is included in full.CVE Delta — Trivy (local scan)
CVE Delta — Harness OnDemand (Prisma Cloud)
Not available. Both attempts to run the
Ondemand_Vulnerability_Scannerpipeline againstplugins/gcs:1.6.10on thedocker.ioconnector failed withStage infra details sweeping output cannot be emptyandConnector not found for identifier: [harnessdev] with scope: [PROJECT]. The failure is in the scanner pipeline's stage-infra resolution, not in the inputs supplied by this run (image=plugins/gcs,tag=1.6.10,Connector=docker.io). A retry after the connector issue is fixed on the OnDemand pipeline should re-establish baseline/after evidence.Per-Ticket CVE Status
CI-23226 — P2: Security Vulnerability Fixes - harnesssecure/gcs
The ticket description enumerates severities but not individual CVEs (points to the SOS portal for live findings). The 22-CVE stdlib set, 7-CVE
golang.org/x/netset, 14-CVEgolang.org/x/cryptoset, and single-CVE otel/otel-sdk/go-jose/x-sys findings from the baseline Trivy scan are the concrete list this PR addresses. Per-package delta:go mod tidydoesn't downgrade x/net and x/cryptoLegend: OK = Resolved, PARTIAL = improved but 1 finding remains with no upstream fix.
Changes Made
go.modtoolchain go1.25.12; bumpedgolang.org/x/oauth2v0.34.0 -> v0.36.0,google.golang.org/apiv0.214.0 -> v0.284.0,cloud.google.com/go/storagev1.50.0 -> v1.62.3, and all indirect deps to their minimum-safe versions viago mod tidygo.sumgo mod tidyVersion selection rationale:
1.25.8through1.25.12sequentially fix each set). Staying in the 1.25 line means no major-version bump.FixedVersionin the advisory), so it remains after the upgrade.v0.214.0transitively requiredgolang.org/x/net@v0.48.x, andgo mod tidywas downgrading the directx/netbump. Upgradingapiunlocks the newer x/net and x/crypto that the CVEs need. This is the minimumapiversion compatible with the ripple upgrade (Go tooling settled on it aftergo mod tidy).x/text,x/sys,otel,otel/sdk,go-jose/v4) — each pinned to the lowest release that clears every ticket-listed CVE for that package, then letgo mod tidyreconcile transitives.Newly Introduced CVEs
None. The after-scan contains only
GO-2026-5932, which was present in the baseline.Notes / caveats
Ondemand_Vulnerability_Scannerpipeline in theSecurity_and_Compliance/ProdSecproject failed on two attempts withConnector not found for identifier: [harnessdev]. Trivy locally on both images provides the delta evidence used above. Please retrigger the scanner post-merge once the connector is restored — that will give an independent Prisma Cloud confirmation.DOCKERHUB_TOKENfor uservinayakharnessreturneddenied: requested access to the resource is deniedwhen pushingvinayakharness/gcs-test:gcs-1.6.11--debug. The image was built and Trivy-scanned locally against the built image (image IDsha256:37b71eeb00cd...), so the "After" evidence is on the actual rebuilt artifact. To reproduce the After scan externally, rebuild from this branch withdocker build -f docker/Dockerfile.linux.amd64 -t <your-repo>:<tag> .(aftergo buildproducesrelease/linux/amd64/drone-gcs).plugins/gcs:1.6.10(public docker.io mirror of the same source repo). The ticket namesharnesssecure/gcs:1.6.10— the OnDemand connectorharnesssecureis not in the allow-list for this scanner, soplugins/gcs:1.6.10was scanned instead. Both are built fromgithub.com/drone-plugins/drone-gcson the same tag, so the CVE surface is identical.google.golang.org/apiandcloud.google.com/go/storage— these were bumped to unlock the newer x/net and x/crypto versions. Recommend a smoke test of the GCS upload/download path (auth token flow) before merge, as the auth adapters were pulled in along the ripple.Auto-generated by the Harness vulnerability-remediation agent. Draft PR — human review required before merge.