-
Notifications
You must be signed in to change notification settings - Fork 16
Bump github.com/openshift-online/ocm-sdk-go from 0.1.456 to 0.1.504 in the ocm-sdk group across 1 directory #55
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
dependabot
wants to merge
1
commit into
main
Choose a base branch
from
dependabot/go_modules/ocm-sdk-f6f7f28218
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
+30
−40
Open
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: openshift-online/rosa-e2e
Length of output: 6685
🏁 Script executed:
Repository: openshift-online/rosa-e2e
Length of output: 770
🌐 Web query:
GO-2025-3488 golang.org/x/oauth2 vulnerability💡 Result:
GO-2025-3488 is a security vulnerability identified in the golang.org/x/oauth2 package, specifically within the golang.org/x/oauth2/jws sub-package [1][2][3]. It is also tracked as CVE-2025-22868 and GHSA-6v2p-p543-phr9 [1][4]. The vulnerability involves improper validation of the syntactic correctness of input tokens [5]. An attacker can exploit this by passing a malicious, malformed token to the application, which causes unexpected memory consumption during the parsing process [1][2][3]. This can lead to a denial of service (DoS) condition, where the application consumes excessive resources, potentially delaying or denying service to legitimate users [5]. The issue was addressed in version 0.27.0 of the golang.org/x/oauth2 package [1][2][3]. Users are advised to update to version 0.27.0 or later to mitigate this risk [5]. The vulnerability was publicly disclosed on February 26, 2025 [1][2][4].
Citations:
🌐 Web query:
GHSA-6v2p-p543-phr9 golang.org/x/oauth2 vulnerability💡 Result:
GHSA-6v2p-p543-phr9 is a high-severity security vulnerability (CVSS 7.5) affecting the golang.org/x/oauth2 module [1]. It is also tracked as CVE-2025-22868 [1][2]. The vulnerability is described as an "Improper Validation of Syntactic Correctness of Input" [1]. Specifically, an attacker can provide a maliciously malformed token that causes the application to consume unexpected amounts of memory during the parsing process, potentially leading to a denial-of-service condition [1][2]. While the advisory is filed under the golang.org/x/oauth2 module, technical discussions indicate that the underlying issue resides within the golang.org/x/oauth2/jws package [3]. Users are advised to update to version 0.27.0 or later to mitigate this vulnerability [1][2]. It is important to note that some projects may include the main oauth2 module without including the vulnerable jws package; in such cases, those projects would not be susceptible to this specific vulnerability [3].
Citations:
🏁 Script executed:
Repository: openshift-online/rosa-e2e
Length of output: 51
🏁 Script executed:
Repository: openshift-online/rosa-e2e
Length of output: 51
Upgrade golang.org/x/oauth2 to address HIGH severity security vulnerability.
The current version v0.23.0 contains CVE-2025-22868 (GO-2025-3488), a vulnerability involving improper validation of token syntax that can cause unexpected memory consumption and lead to denial of service. Upgrade to v0.27.0 or later to resolve this issue.
🧰 Tools
🪛 OSV Scanner (2.3.8)
[HIGH] 74-74: golang.org/x/oauth2 0.23.0: Unexpected memory consumption during token parsing in golang.org/x/oauth2
(GO-2025-3488)
[HIGH] 74-74: golang.org/x/oauth2 0.23.0: golang.org/x/oauth2 Improper Validation of Syntactic Correctness of Input vulnerability
(GHSA-6v2p-p543-phr9)
🤖 Prompt for AI Agents