[Project Darkstar] PSHP-541: Remediate 5 CVEs (openssl-libs, gnutls) in splunk-forwarder-operator#456
Conversation
…33846, CVE-2026-33845, CVE-2026-42009, CVE-2026-42010 — update ubi9/ubi-minimal to 9.8-1784092902 Addresses 5 Important CVEs (CVSS 7.1–8.1) in openssl-libs and gnutls. Updates UBI9 minimal base image from 9.8-1782797275 to 9.8-1784092902 in build/Dockerfile and build/Dockerfile.olm-registry. Ref: PSHP-541 Project Darkstar — automated CVE remediation (contact: Kevin Seiter) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@kseiter-rh: This pull request references PSHP-541 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the vulnerability to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Important Review skippedReview was skipped due to path filters ⛔ Files ignored due to path filters (2)
CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including ⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: kseiter-rh The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/test all |
|
@kseiter-rh: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #456 +/- ##
=======================================
Coverage 72.44% 72.44%
=======================================
Files 11 11
Lines 704 704
=======================================
Hits 510 510
Misses 173 173
Partials 21 21 🚀 New features to boost your workflow:
|
openshift-ci
Bot
added
the
needs-rebase
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
4 participants
Project Darkstar — Automated CVE Remediation
Summary
Updates the UBI9 minimal base image from
9.8-1782797275to9.8-1784092902to remediate 5 Important CVEs in RPM packages (openssl-libs, gnutls).CVEs Remediated (5)
CVEs Already Fixed in Source (12)
These were resolved by commits on 2026-07-01 (before the scan date):
x/net v0.55.0Changes
build/Dockerfile: UBI9 minimal base image9.8-1782797275→9.8-1784092902build/Dockerfile.olm-registry: UBI9 minimal base image9.8-1782797275→9.8-1784092902Not Fixable
Verification
References
Project Darkstar — Automated CVE Remediation | Contact: Kevin Seiter (ROSA Trust Engineering)