Bump go-restful/v3 to v3.10.2 to address PRISMA-2022-0227

[fredbalves86]

Bump go-restful/v3 to v3.10.2 to address PRISMA-2022-0227

Description:
github.com/emicklei/go-restful/v3 module prior to v3.10.0 is vulnerable to Authentication Bypass by Primary Weakness. There is an inconsistency in how go-restful parses URL paths. This inconsistency could lead to several security check bypass in a complex system.

Severity:
High

CVE:
PRISMA-2022-0227

[openshift-ci]

Hi @fredbalves86. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[tmshort]

/hold
Would like to get #510 in before this; as it updates go-restful/v3 to v3.10.1, and subsequently would make an update to v3.10.2 much easier.

[tmshort]

/unhold
#510 has been merged, so this requires a rebase, but it should actually be a trivial change.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fredbalves86
Once this PR has been reviewed and has the lgtm label, please assign awgreene for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tmshort]

@fredbalves86:
This requires additional work.

1. Please git rebase this rather than merging from master
2. The use of go get is required, as it will update go.sum as well; editing go.mod is insufficient.
3. Run make vendor to update the vendor directory.

[dinhxuanvu]

Does this get fixed upstream?

[tmshort]

Does this get fixed upstream?

I don't believe so, I just downstreamed everything. It should probably be done upstream for the three source repos first.

[dinhxuanvu]

Does this get fixed upstream?

I don't believe so, I just downstreamed everything. It should probably be done upstream for the three source repos first.

I would expect this issue to be fixed upstream first then being downstreamed later. However, as long as someone remembers to fix it upstream then I don't care about the order.

[fredbalves86]

Please git rebase this rather than merging from master
The use of go get is required, as it will update go.sum as well; editing go.mod is insufficient.
Run make vendor to update the vendor directory.

Done

[tmshort]

I bumped upstream:
operator-framework/api#290
operator-framework/operator-lifecycle-manager#3011
operator-framework/operator-registry#1136

[dinhxuanvu]

/ok-to-test

[dinhxuanvu]

Please git rebase this rather than merging from master
The use of go get is required, as it will update go.sum as well; editing go.mod is insufficient.
Run make vendor to update the vendor directory.

Done

The merge commit in the middle is still there. Please remove it. Thanks.

[perdasilva]

/retest

[openshift-ci]

@fredbalves86: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-olm-flaky	76cfb73	link	false	/test e2e-gcp-olm-flaky
ci/prow/unit-psm	76cfb73	link	true	/test unit-psm
ci/prow/e2e-gcp-console-olm	76cfb73	link	true	/test e2e-gcp-console-olm
ci/prow/e2e-upgrade	76cfb73	link	true	/test e2e-upgrade
ci/prow/images	76cfb73	link	true	/test images
ci/prow/e2e-gcp-ovn	76cfb73	link	true	/test e2e-gcp-ovn
ci/prow/verify	76cfb73	link	true	/test verify
ci/prow/e2e-gcp-olm	76cfb73	link	true	/test e2e-gcp-olm

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[perdasilva]

could you please run make verify and commit those changes? CI won't get green otherwise ^^

[fredbalves86]

@perdasilva got some errors doing it. Anyone wants to close this one and open a new one with all the stuff needed?
Don't know what else to do with it.

[tmshort]

This was done as part of #567.

[tmshort]

I can't close this... but it should be closed.

[tmshort]

/close

[openshift-ci]

@tmshort: Closed this PR.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.