Bug 1913333 (CVE-2020-28851)

Created golang tracking bugs for this issue:

Affects: epel-7 [bug 1913336]
Affects: fedora-all [bug 1913335]

Removed services which do not appear to use go{lang}, marked remaining services unaffected as specified version not found.

I couldn't find any calls to the affected function "ParseAcceptLanguage" in quay-clair-container, but filed tracking bugs anyway since we are using x/text/language in that container in 3.4 candidate build. As yet there is no fixed version of golang.org/x/text which we are aware of.

Changing CVSS to match NVD, in a worst case scenario.

It can be shown with callgraph[0] which main packages use the affected code. A negative example with the operator-registry container[1]:

Identify main packages:

$ grep -rl --exclude-dir=vendor 'package main' . | grep -E '\.go$' | grep -v 'test' | grep -v 'hack' | xargs dirname 2>/dev/null | sort -u
./cmd/appregistry-server
./cmd/configmap-server
./cmd/initializer
./cmd/opm
./cmd/registry-server

Then iterate over these with `callgraph` and grep for any uses of the affected package:

$ callgraph -format digraph ./cmd/appregistry-server | grep golang.org/x/text/language
$

No results, so this package is not used by the "./cmd/appregistry-server" main package in the operator registry container. 

A positive example with the installer container[2]:

$ callgraph -format digraph ./cmd/openshift-install | golang.org/x/text/language
"(*golang.org/x/text/language.Tag).tag" "(golang.org/x/text/internal/language/compact.Tag).Tag"
"(golang.org/x/text/language.Tag).MarshalText" "(*golang.org/x/text/language.Tag).tag"
"(golang.org/x/text/language.Tag).MarshalText" "(golang.org/x/text/internal/language.Tag).MarshalText"
...

We can see that there are functions from the affected package used by "cmd/openshift-install". Therefore we can consider the openshift installer container affected by this CVE.

The was repeated for all OpenShift source code repositories.

[0] https://github.com/golang/tools/blob/master/cmd/callgraph/main.go
[1] https://github.com/operator-framework/operator-registry
[2] https://github.com/openshift/installer

Created git-lfs tracking bugs for this issue:

Affects: fedora-all [bug 1929256]

In reply to comment #18:
> It can be shown with callgraph[0] which main packages use the affected code.
> A negative example with the operator-registry container[1]:
> 
> Identify main packages:
> 
> $ grep -rl --exclude-dir=vendor 'package main' . | grep -E '\.go$' | grep -v
> 'test' | grep -v 'hack' | xargs dirname 2>/dev/null | sort -u
> ./cmd/appregistry-server
> ./cmd/configmap-server
> ./cmd/initializer
> ./cmd/opm
> ./cmd/registry-server
> 
> Then iterate over these with `callgraph` and grep for any uses of the
> affected package:

`go list -deps` can also be used instead of `callgraph`. Using `go list -deps`, we get the same list of OpenShift components. We can go further and say that the affected code is not only unused, it is not imported at all, and therefore not built into the binaries.

Statement:

Below Red Hat products include the affected version of 'golang.org/x/text', however the language package is not being used and hence they are rated as having a security impact of Low. A future update may address this issue.

* Red Hat OpenShift Container Storage 4
* OpenShift ServiceMesh (OSSM)
* Red Hat Gluster Storage 3
* Windows Container Support for Red Hat OpenShift

Only three components in OpenShift Container Platform include the affected package, 'golang.org/x/text/language' , the installer, baremetal installer and thanos container images. All other components that include a version of 'golang.org/x/text' do not include the 'language' package and are therefore not affected.

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8
  Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7

Via RHSA-2021:1168 https://access.redhat.com/errata/RHSA-2021:1168

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-28851

Upstream fix: https://github.com/golang/text/commit/e3aa4adf54f644ca0cb35f1f1fb19b239c40ef04

This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 7
  Red Hat Advanced Cluster Management for Kubernetes 2.3 for RHEL 8

Via RHSA-2021:3016 https://access.redhat.com/errata/RHSA-2021:3016

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.10

Via RHSA-2022:0577 https://access.redhat.com/errata/RHSA-2022:0577

This issue has been addressed in the following products:

  OpenShift Service Mesh 2.0

Via RHSA-2022:1276 https://access.redhat.com/errata/RHSA-2022:1276

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:7129 https://access.redhat.com/errata/RHSA-2022:7129

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:7954 https://access.redhat.com/errata/RHSA-2022:7954