From 1ca9cadffe83f1868fa87dc1dec6b8f267b2f214 Mon Sep 17 00:00:00 2001 From: Deirdre Malone Date: Wed, 26 Aug 2026 09:52:04 +0100 Subject: [PATCH] OCPBUGS-93706: fix for CVE-2026-42151 --- rh-manifest.txt | 214 ++++++++++++------------- storage/remote/azuread/azuread.go | 5 +- storage/remote/azuread/azuread_test.go | 11 +- 3 files changed, 111 insertions(+), 119 deletions(-) diff --git a/rh-manifest.txt b/rh-manifest.txt index ed852db821a..42e6183fa78 100644 --- a/rh-manifest.txt +++ b/rh-manifest.txt @@ -1,107 +1,111 @@ @adobe/css-tools@4.4.0 -@babel/code-frame@7.24.7 -@babel/helper-validator-identifier@7.24.7 -@babel/highlight@7.24.7 +@babel/code-frame@7.26.2 +@babel/helper-validator-identifier@7.25.9 @babel/runtime@7.24.8 @babel/runtime@7.25.6 -@codemirror/autocomplete@6.17.0 -@codemirror/autocomplete@6.18.1 -@codemirror/commands@6.6.0 +@codemirror/autocomplete@6.18.4 @codemirror/commands@6.6.1 -@codemirror/language@6.10.2 -@codemirror/lint@6.8.1 +@codemirror/commands@6.7.1 +@codemirror/language@6.10.8 +@codemirror/lint@6.8.4 @codemirror/search@6.5.6 -@codemirror/state@6.4.1 +@codemirror/search@6.5.8 +@codemirror/state@6.5.0 @codemirror/theme-one-dark@6.1.2 -@codemirror/view@6.33.0 -@codemirror/view@6.34.1 +@codemirror/view@6.36.1 +@codemirror/view@6.36.2 @floating-ui/core@1.6.7 -@floating-ui/dom@1.6.10 -@floating-ui/react-dom@2.1.1 -@floating-ui/react@0.26.23 -@floating-ui/utils@0.2.7 +@floating-ui/dom@1.6.12 +@floating-ui/react-dom@2.1.2 +@floating-ui/react@0.26.28 +@floating-ui/utils@0.2.8 @forevolve/bootstrap-dark@4.0.2 -@fortawesome/fontawesome-common-types@6.5.2 -@fortawesome/fontawesome-svg-core@6.5.2 -@fortawesome/free-solid-svg-icons@6.5.2 -@fortawesome/react-fontawesome@0.2.0 +@fortawesome/fontawesome-common-types@6.7.2 +@fortawesome/fontawesome-svg-core@6.7.2 +@fortawesome/free-solid-svg-icons@6.7.2 +@fortawesome/react-fontawesome@0.2.2 @hypnosphi/create-react-context@0.3.1 -@lezer/common@1.2.1 -@lezer/highlight@1.2.0 +@lezer/common@1.2.3 @lezer/highlight@1.2.1 @lezer/lr@1.4.2 -@mantine/code-highlight@7.13.1 -@mantine/core@7.13.1 -@mantine/dates@7.13.1 -@mantine/hooks@7.13.1 -@mantine/notifications@7.13.1 -@mantine/store@7.13.1 +@mantine/code-highlight@7.15.2 +@mantine/core@7.15.3 +@mantine/dates@7.15.3 +@mantine/hooks@7.15.3 +@mantine/notifications@7.15.3 +@mantine/store@7.15.3 +@marijn/find-cluster-break@1.0.2 @microsoft/fetch-event-source@2.0.1 -@nexucis/fuzzy@0.4.1 @nexucis/fuzzy@0.5.1 -@nexucis/kvsearch@0.8.1 @nexucis/kvsearch@0.9.1 +@parcel/watcher-android-arm64@2.5.0 +@parcel/watcher-darwin-arm64@2.5.0 +@parcel/watcher-darwin-x64@2.5.0 +@parcel/watcher-freebsd-x64@2.5.0 +@parcel/watcher-linux-arm-glibc@2.5.0 +@parcel/watcher-linux-arm-musl@2.5.0 +@parcel/watcher-linux-arm64-glibc@2.5.0 +@parcel/watcher-linux-arm64-musl@2.5.0 +@parcel/watcher-linux-x64-glibc@2.5.0 +@parcel/watcher-linux-x64-musl@2.5.0 +@parcel/watcher-win32-arm64@2.5.0 +@parcel/watcher-win32-ia32@2.5.0 +@parcel/watcher-win32-x64@2.5.0 +@parcel/watcher@2.5.0 @prometheus-io/codemirror-promql@0.300.1 -@prometheus-io/codemirror-promql@0.55.0 +@prometheus-io/codemirror-promql@0.302.1 @prometheus-io/lezer-promql@0.300.1 -@prometheus-io/lezer-promql@0.55.0 -@prometheus-io/mantine-ui@0.300.1 -@reduxjs/toolkit@2.2.7 -@remix-run/router@1.19.2 -@tabler/icons-react@3.19.0 -@tabler/icons@3.19.0 -@tanstack/query-core@5.59.0 -@tanstack/react-query@5.59.0 +@prometheus-io/lezer-promql@0.302.1 +@prometheus-io/mantine-ui@0.302.1 +@reduxjs/toolkit@2.5.0 +@tabler/icons-react@3.28.1 +@tabler/icons@3.28.1 +@tanstack/query-core@5.62.9 +@tanstack/react-query@5.62.11 @testing-library/dom@10.4.0 -@testing-library/jest-dom@6.5.0 -@testing-library/react@16.0.1 +@testing-library/jest-dom@6.6.3 +@testing-library/react@16.1.0 @types/aria-query@5.0.4 -@types/http-proxy@1.17.14 -@types/lodash@4.17.9 -@types/node@20.14.13 -@types/prop-types@15.7.12 -@types/react-dom@18.3.0 -@types/react@18.3.5 +@types/cookie@0.6.0 +@types/http-proxy@1.17.15 +@types/lodash@4.17.13 +@types/node@22.10.3 +@types/react-dom@19.0.3 +@types/react@19.0.6 @types/sanitize-html@2.13.0 -@types/use-sync-external-store@0.0.3 -@uiw/codemirror-extensions-basic-setup@4.23.3 -@uiw/react-codemirror@4.23.3 +@types/use-sync-external-store@0.0.6 +@uiw/codemirror-extensions-basic-setup@4.23.7 +@uiw/react-codemirror@4.23.7 ansi-regex@5.0.1 -ansi-styles@3.2.1 ansi-styles@4.3.0 ansi-styles@5.2.0 -anymatch@3.1.3 aria-query@5.3.0 -binary-extensions@2.3.0 bootstrap@4.6.2 -braces@3.0.2 +braces@3.0.3 call-bind@1.0.7 -chalk@2.4.2 chalk@3.0.0 chalk@4.1.2 -chokidar@3.6.0 +chokidar@4.0.1 classnames@2.5.1 clsx@2.1.1 codemirror@6.0.1 -color-convert@1.9.3 color-convert@2.0.1 -color-name@1.1.3 color-name@1.1.4 -colors@0.5.1 compute-scroll-into-view@3.1.0 +cookie@1.0.2 copy-to-clipboard@3.3.3 crelt@1.0.6 css.escape@1.5.1 csstype@3.1.3 dayjs@1.11.13 -debug@4.3.4 +debug@4.4.0 deep-equal@1.1.2 deepmerge@4.3.1 define-data-property@1.1.4 define-properties@1.2.1 dequal@2.0.3 +detect-libc@1.0.3 detect-node-es@1.1.0 -discontinuous-range@1.0.0 dom-accessibility-api@0.5.16 dom-accessibility-api@0.6.3 dom-helpers@3.4.0 @@ -110,24 +114,21 @@ dom-serializer@2.0.0 domelementtype@2.3.0 domhandler@5.0.3 domutils@3.1.0 -downshift@9.0.6 +downshift@9.0.8 entities@4.5.0 es-define-property@1.0.0 es-errors@1.3.0 -escape-string-regexp@1.0.5 escape-string-regexp@4.0.0 eventemitter3@4.0.7 -fill-range@7.0.1 +fill-range@7.1.1 follow-redirects@1.15.6 fsevents@2.3.3 function-bind@1.1.2 functions-have-names@1.2.3 get-intrinsic@1.2.4 get-nonce@1.0.1 -glob-parent@5.1.2 gopd@1.0.1 gud@1.0.0 -has-flag@3.0.0 has-flag@4.0.0 has-property-descriptors@1.0.2 has-proto@1.0.3 @@ -138,84 +139,74 @@ highlight.js@11.10.0 history@4.10.1 hoist-non-react-statics@3.3.2 htmlparser2@8.0.2 -http-proxy-middleware@3.0.0 +http-proxy-middleware@3.0.3 http-proxy@1.18.1 immer@10.1.1 -immutable@4.3.5 +immutable@5.0.3 indent-string@4.0.0 -invariant@2.2.4 is-arguments@1.1.1 -is-binary-path@2.1.0 is-date-object@1.0.5 is-extglob@2.1.1 is-glob@4.0.3 is-number@7.0.0 -is-plain-obj@3.0.0 is-plain-object@5.0.0 is-regex@1.1.4 isarray@0.0.1 jquery.flot.tooltip@0.9.0 jquery@3.7.1 js-tokens@4.0.0 -lodash.flattendeep@4.4.0 lodash@4.17.21 loose-envify@1.4.0 -lru-cache@11.0.1 -lru-cache@7.18.3 +lru-cache@11.0.2 lz-string@1.5.0 -micromatch@4.0.5 +micromatch@4.0.8 min-indent@1.0.1 -moment-timezone@0.5.45 +moment-timezone@0.5.46 moment@2.29.4 moment@2.30.1 -ms@2.1.2 -nanoid@3.3.7 -nearley@2.7.10 -nomnom@1.6.2 -normalize-path@3.0.0 +ms@2.1.3 +nanoid@3.3.8 +node-addon-api@7.1.1 object-assign@4.1.1 object-is@1.1.6 object-keys@1.1.1 parse-srcset@1.0.2 -path-to-regexp@1.8.0 -picocolors@1.0.0 -picocolors@1.1.0 +path-to-regexp@1.9.0 +picocolors@1.1.1 picomatch@2.3.1 popper.js@1.16.1 postcss@8.4.38 -postcss@8.4.47 +postcss@8.4.49 pretty-format@27.5.1 prop-types@15.8.1 -railroad-diagrams@1.0.0 -randexp@0.4.6 react-copy-to-clipboard@5.1.0 react-dom@17.0.2 -react-dom@18.3.1 +react-dom@19.0.0 react-infinite-scroll-component@6.1.0 react-is@16.13.1 react-is@17.0.2 react-is@18.2.0 react-lifecycles-compat@3.0.4 -react-number-format@5.4.1 +react-number-format@5.4.3 react-popper@1.3.11 -react-redux@9.1.2 -react-remove-scroll-bar@2.3.6 -react-remove-scroll@2.5.10 +react-redux@9.2.0 +react-remove-scroll-bar@2.3.8 +react-remove-scroll@2.6.2 react-resize-detector@7.1.2 react-router-dom@5.3.4 -react-router-dom@6.26.2 +react-router-dom@7.1.1 react-router@5.3.4 -react-router@6.26.2 +react-router@7.1.1 react-shallow-renderer@16.15.0 -react-style-singleton@2.2.1 +react-style-singleton@2.2.3 react-test-renderer@17.0.2 -react-textarea-autosize@8.5.3 +react-textarea-autosize@8.5.6 react-transition-group@3.0.0 react-transition-group@4.4.5 react@17.0.2 -react@18.3.1 +react@19.0.0 reactstrap@8.10.1 -readdirp@3.6.0 +readdirp@4.0.2 redent@3.0.0 redux-thunk@3.1.0 redux@5.0.1 @@ -224,19 +215,18 @@ regexp.prototype.flags@1.5.2 requires-port@1.0.0 reselect@5.1.1 resolve-pathname@3.0.0 -ret@0.1.15 -sanitize-html@2.13.0 -sass@1.77.6 +sanitize-html@2.14.0 +sass@1.83.0 scheduler@0.20.2 -scheduler@0.23.2 +scheduler@0.25.0 serialize-query-params@2.0.2 +set-cookie-parser@2.7.1 set-function-length@1.2.2 set-function-name@2.0.2 source-map-js@1.2.0 source-map-js@1.2.1 strip-indent@3.0.0 style-mod@4.1.2 -supports-color@5.5.0 supports-color@7.2.0 tabbable@6.2.0 tempusdominus-bootstrap-4@5.39.2 @@ -248,19 +238,19 @@ to-regex-range@5.0.1 toggle-selection@1.0.6 tslib@2.6.2 tslib@2.7.0 -type-fest@4.26.0 +turbo-stream@2.4.0 +type-fest@4.29.0 typed-styles@0.0.7 -underscore@1.4.4 -undici-types@5.26.5 +undici-types@6.20.0 uplot-react@1.2.2 -uplot@1.6.30 -use-callback-ref@1.3.2 -use-composed-ref@1.3.0 -use-isomorphic-layout-effect@1.1.2 -use-latest@1.2.1 +uplot@1.6.31 +use-callback-ref@1.3.3 +use-composed-ref@1.4.0 +use-isomorphic-layout-effect@1.2.0 +use-latest@1.3.0 use-query-params@2.2.1 -use-sidecar@1.1.2 -use-sync-external-store@1.2.2 +use-sidecar@1.1.3 +use-sync-external-store@1.4.0 value-equal@1.0.1 w3c-keyname@2.2.8 warning@4.0.3 diff --git a/storage/remote/azuread/azuread.go b/storage/remote/azuread/azuread.go index 20ec53d6f65..6c3d92d7da4 100644 --- a/storage/remote/azuread/azuread.go +++ b/storage/remote/azuread/azuread.go @@ -28,6 +28,7 @@ import ( "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy" "github.com/Azure/azure-sdk-for-go/sdk/azidentity" "github.com/google/uuid" + config_util "github.com/prometheus/common/config" ) // Clouds. @@ -56,7 +57,7 @@ type OAuthConfig struct { ClientID string `yaml:"client_id,omitempty"` // ClientSecret is the clientSecret of the azure active directory application that is being used to authenticate. - ClientSecret string `yaml:"client_secret,omitempty"` + ClientSecret config_util.Secret `yaml:"client_secret,omitempty"` // TenantID is the tenantId of the azure active directory application that is being used to authenticate. TenantID string `yaml:"tenant_id,omitempty"` @@ -277,7 +278,7 @@ func newManagedIdentityTokenCredential(clientOpts *azcore.ClientOptions, managed // newOAuthTokenCredential returns new OAuth token credential. func newOAuthTokenCredential(clientOpts *azcore.ClientOptions, oAuthConfig *OAuthConfig) (azcore.TokenCredential, error) { opts := &azidentity.ClientSecretCredentialOptions{ClientOptions: *clientOpts} - return azidentity.NewClientSecretCredential(oAuthConfig.TenantID, oAuthConfig.ClientID, oAuthConfig.ClientSecret, opts) + return azidentity.NewClientSecretCredential(oAuthConfig.TenantID, oAuthConfig.ClientID, string(oAuthConfig.ClientSecret), opts) } // newSDKTokenCredential returns new SDK token credential. diff --git a/storage/remote/azuread/azuread_test.go b/storage/remote/azuread/azuread_test.go index 08870382ec4..e33b55e88bd 100644 --- a/storage/remote/azuread/azuread_test.go +++ b/storage/remote/azuread/azuread_test.go @@ -25,6 +25,7 @@ import ( "github.com/Azure/azure-sdk-for-go/sdk/azcore/policy" "github.com/google/uuid" "github.com/prometheus/client_golang/prometheus/promhttp" + config_util "github.com/prometheus/common/config" "github.com/stretchr/testify/mock" "github.com/stretchr/testify/require" "github.com/stretchr/testify/suite" @@ -32,11 +33,11 @@ import ( ) const ( - dummyAudience = "dummyAudience" - dummyClientID = "00000000-0000-0000-0000-000000000000" - dummyClientSecret = "Cl1ent$ecret!" - dummyTenantID = "00000000-a12b-3cd4-e56f-000000000000" - testTokenString = "testTokenString" + dummyAudience = "dummyAudience" + dummyClientID = "00000000-0000-0000-0000-000000000000" + dummyClientSecret config_util.Secret = "Cl1ent$ecret!" + dummyTenantID = "00000000-a12b-3cd4-e56f-000000000000" + testTokenString = "testTokenString" ) func testTokenExpiry() time.Time { return time.Now().Add(5 * time.Second) }