OCPBUGS-88721: CVE-2026-42338#16630
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
openshift-ci-robot
added
jira/severity-important
|
@germanparente: This pull request references Jira Issue OCPBUGS-88721, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
needs-rebase
WalkthroughA new ChangesDependency Resolution Override
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: germanparente The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@germanparente: This pull request references Jira Issue OCPBUGS-88721, which is valid. 3 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@frontend/package.json`:
- Around line 338-339: The frontend/package.json resolutions section contains
two issues: the minimatch resolution is vulnerable to HIGH-severity ReDoS flaws
in versions up to 10.2.2 and needs to be upgraded to exactly 10.2.3, and both
resolutions use caret ranges which allow floating versions instead of exact
pinning. Fix the minimatch resolution by changing the version from the caret
range to exactly 10.2.3, and change the ip-address resolution from a caret range
to an exact version pin to follow supply-chain best practices and ensure
deterministic installs across all environments.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: ad4aaa4b-ba2e-42c5-8cf1-0a9765fa7ab0
⛔ Files ignored due to path filters (1)
frontend/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
frontend/package.json
| "minimatch@^10.1.2": "^10.2.1", | ||
| "ip-address": "^10.1.1" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Locate lockfile =="
fd -i '^yarn\.lock$'
echo
echo "== Verify resolved ip-address entries in lockfile =="
rg -n -C2 '(^|[" ])ip-address@' frontend/yarn.lock
echo
echo "== Ensure no vulnerable 9.x ip-address remains =="
if rg -n 'ip-address@.*\b9\.' frontend/yarn.lock; then
echo "Found ip-address 9.x entries; please remove/override fully."
exit 1
else
echo "No ip-address 9.x entries found."
fi
echo
echo "== Query OSV for ip-address 10.2.0 =="
curl -sS https://api.osv.dev/v1/query \
-H 'content-type: application/json' \
-d '{"package":{"name":"ip-address","ecosystem":"npm"},"version":"10.2.0"}' | jq .Repository: openshift/console
Length of output: 631
🏁 Script executed:
cd frontend && sed -n '330,345p' package.jsonRepository: openshift/console
Length of output: 517
🏁 Script executed:
#!/bin/bash
# Check for CVEs in minimatch@10.2.1
curl -sS https://api.osv.dev/v1/query \
-H 'content-type: application/json' \
-d '{"package":{"name":"minimatch","ecosystem":"npm"},"version":"10.2.1"}' | jq .Repository: openshift/console
Length of output: 27777
🏁 Script executed:
#!/bin/bash
# Check if there are newer patch versions available for both packages
# Also check what versions are currently in use in the codebase
cd frontend && rg -n 'minimatch|ip-address' yarn.lock | head -20Repository: openshift/console
Length of output: 777
Upgrade minimatch to 10.2.3 to remediate HIGH-severity ReDoS vulnerabilities; use exact pinning in resolutions.
Lines 338–339 have two issues:
-
Minimatch vulnerability: The current resolution pins
minimatch@^10.1.2to^10.2.1, which is vulnerable to two HIGH-severity ReDoS flaws (GHSA-23c5-xmqv-rm74, GHSA-7r86-cg39-jmmj, CVE-2026-27904, CVE-2026-27903). Both affect versions 10.0.0–10.2.2 and are fixed in 10.2.3. Caret ranges also allow floating to future patch releases, defeating deterministic remediation. -
Imprecise resolutions: Supply-chain best practice requires exact versions in
resolutionsoverrides to prevent accidental drift across installs.
Suggested fix
- "minimatch@^10.1.2": "^10.2.1",
- "ip-address": "^10.1.1"
+ "minimatch@^10.1.2": "10.2.3",
+ "ip-address": "10.2.0"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@frontend/package.json` around lines 338 - 339, The frontend/package.json
resolutions section contains two issues: the minimatch resolution is vulnerable
to HIGH-severity ReDoS flaws in versions up to 10.2.2 and needs to be upgraded
to exactly 10.2.3, and both resolutions use caret ranges which allow floating
versions instead of exact pinning. Fix the minimatch resolution by changing the
version from the caret range to exactly 10.2.3, and change the ip-address
resolution from a caret range to an exact version pin to follow supply-chain
best practices and ensure deterministic installs across all environments.
Source: Coding guidelines
|
/rebase |
openshift-ci
Bot
removed
the
needs-rebase
|
@germanparente: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
CONSOLE Features and Fixes:
Solution description
Resolve CVE-2026-42338 by adding a yarn resolution for
ip-addressto^10.1.1. The transitive dependency (viasocks-proxy-agent→socks) was at 9.0.5, which has an XSS vulnerability inAddress6HTML-emitting methods. Updated to 10.2.0.Reviewers and assignees:
Test cases:
No functional changes —
ip-addressis a transitive dependency not directly used by console source code. Verified the lockfile resolves to 10.2.0.Additional info:
socksfor SOCKS proxy address parsing; console never imports or renders its output as HTML.Screen shots / gifs / design review:
N/A — no visual changes.
🤖 Generated with Claude Code
Summary by CodeRabbit