Repository navigation
fix(marketplace): bump go-jose to v4.1.6 for GHSA-mgcc-cww5-fp2q - #7
Merged
Merged
Conversation
go-jose v4.1.4 (pulled in by go-oidc) is flagged High by Grype: DoS when parsing JWKs with RSA keys. v4.1.6 caps the RSA modulus accepted in JWK parsing at 4096 bits.
Kim-YeongHyeon
marked this pull request as ready for review
October 29, 2026 03:36
cokestrawberry
approved these changes
Oct 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
문제
cryptolabinc/minio:2025-10-15-go1.26.9이미지를 Grype로 검사하면 High 등급 1건이 나옵니다.github.com/go-jose/go-jose/v4v4.1.4envector nightly의
cve-scan-report가 이 이미지를 검사 대상에 넣고 있습니다.원인
go-jose/v4는cmd의 OpenID 연동이 쓰는github.com/coreos/go-oidc/v3/oidc를 통해 들어오는 indirect 의존성입니다. 2026-10-27에 RSA 키가 든 JWK를 파싱할 때 DoS가 가능한 취약점이 공개되었습니다.채택한 해결 방안
go get github.com/go-jose/go-jose/v4@v4.1.6으로go.mod의 indirect 버전을 올렸습니다.go mod tidy는 main에서도 go-openapi 테스트 의존성 문제로 실패하므로 실행하지 않았고, 그래서go.sum에는 이전 버전 줄이 남아 있습니다. 빌드에는 영향이 없습니다.선택 이유
v4.1.6이 이 취약점을 고친 최초 버전이자 최신 릴리스입니다. v4.1.6은 JWK 파싱에서 RSA modulus를 4096비트로 제한합니다. go-oidc는 JWKS 전체를
jose.JSONWebKeySet하나로 파싱하므로, OpenID IdP의 JWKS에 4096비트를 넘는 RSA 키가 있으면 해당 IdP 검증이 실패합니다.검증 방법
CGO_ENABLED=0 go build -tags kqueue -trimpath .(Dockerfile과 같은 옵션) 성공.go version -m에서 go1.26.9, go-jose v4.1.6 확인go vet ./cmd/통과,go test -short -run 'OpenID|OIDC|Oidc|STS' ./cmd/통과관련 문서
docs/runbooks/marketplace/gcp-infra-ops.md의 "MinIO image: ours, not upstream" 항목 (빌드·태그 절차)