fix(deps): update backend dependencies - #784

Details

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds.

Severity

Unknown

References

• https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
• https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Details

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Severity

Unknown

References

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
• https://github.com/open-telemetry/opentelemetry-go/pull/7880

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Details

A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache.

This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log.

All tiles are now correctly verified against their parents.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80744
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/814960
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Details

A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log.

This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log.

In order to determine if you have been affected:

rm -r go.sum go.work.sum vendor/ && go mod tidy

Severity

Unknown

References

• https://go.dev/issue/80745
• https://groups.google.com/g/golang-announce/c/94pEornpRlI
• https://go.dev/cl/815000
• https://go.dev/cl/815020

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Details

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:

• Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing Metadata or RequestedServerName fields.
• Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.
• Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing NOT rules around unsupported fields.

Impact

What kind of vulnerability is it? Who is impacted?

xDS RBAC Authorization Bypass via Metadata & RequestedServerName matchers

• Affected Component: xDS RBAC
• Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported permission and principal rules (specifically Metadata and RequestedServerName) were silently ignored and treated as no-ops.
  • If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.
• If these unsupported rules were nested inside logical NOT rules (Permission_NotRule / Principal_NotId) or multi-condition OR/AND rules, silently dropping them changed the boolean logic flow of the authorization engine.

As a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.

HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts

• Affected Component: HTTP/2 transport
• Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as SETTINGS ACKs or server-initiated RST_STREAMs.

When a client initiated a rapid flood of stream creation (HEADERS) immediately followed by stream termination RST_STREAM, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).

Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules

• Affected Component: xDS RBAC
• Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a NOT rule wrapped an unsupported or unhandled field (such as SourcedMetadata), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.

An attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a NOT rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).

Patches

Has the problem been patched? What versions should users upgrade to?

All three issues have been fixed in master and will be released in 1.82.1 shortly.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:

• For xDS RBAC Vulnerabilities & Panics: Ensure that upstream xDS management servers do not push RBAC policies containing Metadata, RequestedServerName, or NOT rules wrapping unsupported fields (such as SourcedMetadata) to grpc-go servers.
• For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.

Severity

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf
• https://github.com/grpc/grpc-go/pull/9236
• https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935
• https://github.com/grpc/grpc-go/releases/tag/v1.82.1
• https://github.com/advisories/GHSA-hrxh-6v49-42gf

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine (internal/xds/rbac) and the HTTP/2 transport server implementation (internal/transport). These vulnerabilities could result in:

• Authorization Bypass (Fail-Open) when translating xDS RBAC policies containing Metadata or RequestedServerName fields.
• Denial of Service (High CPU Consumption) due to an HTTP/2 Rapid Reset mitigation bypass during client-initiated stream resets.
• Denial of Service (Server Panic) when parsing crafted xDS RBAC policies containing NOT rules around unsupported fields.

Impact

What kind of vulnerability is it? Who is impacted?

xDS RBAC Authorization Bypass via Metadata & RequestedServerName matchers

• Affected Component: xDS RBAC
• Impact: When building policy matchers for gRPC RBAC from xDS configurations, unsupported permission and principal rules (specifically Metadata and RequestedServerName) were silently ignored and treated as no-ops.
  • If an authorization policy relied purely on these matchers for access control, treating those rules as no-ops effectively removed the restrictions.
• If these unsupported rules were nested inside logical NOT rules (Permission_NotRule / Principal_NotId) or multi-condition OR/AND rules, silently dropping them changed the boolean logic flow of the authorization engine.

As a result, policy evaluation decisions could fail open, allowing unauthorized clients to access protected gRPC services or resources.

HTTP/2 Rapid Reset Mitigation Bypass / Denial of Service via Stream Aborts

• Affected Component: HTTP/2 transport
• Impact: Earlier mitigations in grpc-go for HTTP/2 Rapid Reset only applied threshold checks to items that directly resulted in control frames being written back to the wire, such as SETTINGS ACKs or server-initiated RST_STREAMs.

When a client initiated a rapid flood of stream creation (HEADERS) immediately followed by stream termination RST_STREAM, items queued up in the control buffer without counting against the transport response frame threshold. An attacker can repeatedly trigger this flood sequence to bypass reader blocking, resulting in high CPU usage, and Denial of Service (DoS).

Denial of Service (Panic) in xDS RBAC Engine via Unsupported Fields inside NOT Rules

• Affected Component: xDS RBAC
• Impact: The xDS RBAC policy translators recursively generate matchers for nested rules. When a NOT rule wrapped an unsupported or unhandled field (such as SourcedMetadata), the recursive step returned an empty matcher. This could result in a runtime panic when the RBAC engine attempts to authorize an incoming request.

An attacker or misconfigured/malicious xDS management server delivering an LDS/RDS update containing a NOT rule around an unhandled field causes the gRPC server process to crash immediately (CWE-248 / Denial of Service).

Patches

Has the problem been patched? What versions should users upgrade to?

All three issues have been fixed in master and will be released in 1.82.1 shortly.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

If upgrading grpc-go immediately is not possible, apply the following workarounds based on your deployment architecture:

• For xDS RBAC Vulnerabilities & Panics: Ensure that upstream xDS management servers do not push RBAC policies containing Metadata, RequestedServerName, or NOT rules wrapping unsupported fields (such as SourcedMetadata) to grpc-go servers.
• For HTTP/2 Rapid Reset DOS: Configure upstream reverse proxies or load balancers (such as Envoy) with strict HTTP/2 max_concurrent_streams limits and active rate limiting on RST_STREAM frequency per connection.

Severity

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf
• https://github.com/grpc/grpc-go/pull/9236
• https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935
• https://github.com/grpc/grpc-go
• https://github.com/grpc/grpc-go/releases/tag/v1.82.1

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Details

Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc

Severity

Unknown

References

• https://github.com/grpc/grpc-go/security/advisories/GHSA-hrxh-6v49-42gf
• https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935
• https://github.com/grpc/grpc-go/pull/9236
• https://github.com/grpc/grpc-go/releases/tag/v1.82.1

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

v18.7.0: Apache Arrow Go v18.7.0

Compare Source

What's Changed

• fix(release): keys download by @​zeroshade in #​781
• parquet/compress: enable WithAllLitEntropyCompression(true) for zstd by @​varun0630 in #​779
• release: fix syntax error in verify_rc.sh by @​amoeba in #​782
• chore: Bump modernc.org/sqlite from 1.49.1 to 1.50.0 by @​dependabot[bot] in #​783
• fix(parquet): align dictionary fallback with parquet-mr by @​twuebi in #​786
• fix(arrow/cdata): make nativeCRecordBatchReader deterministic by @​zeroshade in #​793
• fix(compute/kernels): map FSB byte-width to numeric memo type for is_in by @​SAY-5 in #​797
• chore: Bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @​dependabot[bot] in #​798
• chore: Bump github.com/klauspost/compress from 1.18.5 to 1.18.6 by @​dependabot[bot] in #​799
• fix(arrow/flight): deliver response headers eagerly in streaming client middleware by @​zeroshade in #​801
• chore: Bump golang.org/x/sys from 0.43.0 to 0.44.0 by @​dependabot[bot] in #​810
• chore: Bump modernc.org/sqlite from 1.50.0 to 1.50.1 by @​dependabot[bot] in #​811
• fix(ipc): preserve map child field metadata by @​dimakuz in #​809
• fix(avro): error on complex (non-nullable) unions instead of silently dropping (#​777) by @​SAY-5 in #​808
• fix(parquet/metadata): do not pre-set hasDistinctCount in stat factories by @​SAY-5 in #​807
• feat(compute): support casts between binary/string and binary_view/string_view by @​zeroshade in #​802
• fix(arrow/array): preserve large integer precision in JSON decoding by @​zeroshade in #​816
• feat(arrow/array): add Resize method to RecordBuilder by @​oakad in #​805
• chore: Bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @​dependabot[bot] in #​818
• chore: Bump github.com/substrait-io/substrait-go/v8 from 8.1.0 to 8.1.1 by @​dependabot[bot] in #​819
• perf(parquet/pqarrow): cap RecordReader batch size to actual row count by @​paveon in #​817
• docs(parquet): correct DefaultDataPageSize comment from 1K to 1M by @​zeroshade in #​822
• fix(arrow/array): silence copylocks warning in numeric_generic.go by @​zeroshade in #​823
• feat(arrow/compute/exprs): support expr.IntervalYearToMonthLiteral in literalToDatum by @​zeroshade in #​825
• chore: Bump golang.org/x/sys from 0.44.0 to 0.45.0 by @​dependabot[bot] in #​829
• chore: Bump docker/login-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​828
• fix(parquet): return error instead of panicking on first-write failure by @​zeroshade in #​824
• [Parquet] Add SIMD-accelerated byte-stream-split decoding by @​daniel-adam-tfs in #​654
• perf(parquet/metadata): avoid constructing ColumnChunkMetaData in page index range determination by @​paveon in #​831
• chore: Bump modernc.org/sqlite from 1.50.1 to 1.51.0 by @​dependabot[bot] in #​837
• chore: Bump github.com/pierrec/lz4/v4 from 4.1.26 to 4.1.27 by @​dependabot[bot] in #​836
• chore: Bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​835
• feat: filter and take for dictionary arrays by @​lesam in #​716
• fix(arrow/array): adding string boundary checking for (*String).Value by @​happydave1 in #​844
• fix(parquet/variant): correct binary search bounds in ObjectValue.ValueByKey by @​qzyu999 in #​841
• fix(parquet/variant): correct is_large bit position in valueSize for arrays by @​qzyu999 in #​840
• feat(avro): support local-timestamp logical types by @​abir-eon in #​832
• chore: Bump modernc.org/sqlite from 1.51.0 to 1.52.0 by @​dependabot[bot] in #​845
• chore: Bump golang.org/x/sys from 0.45.0 to 0.46.0 by @​dependabot[bot] in #​846
• fix(avro): append raw bytes by @​matan129 in #​850
• fix(arrow/array): use scale-aware ValueStr in decimal array String() by @​zeroshade in #​849
• feat(parquet/pqarrow): support writing LARGE_LIST types by @​lidavidm in #​838
• chore: Bump golang.org/x/sync from 0.20.0 to 0.21.0 by @​dependabot[bot] in #​847
• fix(arrow/scalar): implement Release()/Retain() on *scalar.Extension by @​zeroshade in #​851
• docs(arrow/ipc): document that Writer and FileWriter are not concurrency safe by @​zeroshade in #​856
• fix(parquet): add WriteBatchSpacedWithError to surface spaced-write failures by @​zeroshade in #​852
• ci: pin Go to go.mod in RC verify so the matching toolchain is used by @​zeroshade in #​857
• chore: Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​860
• chore: Bump modernc.org/sqlite from 1.52.0 to 1.53.0 by @​dependabot[bot] in #​861
• feat(arrow/extensions): add UnshredVariant to collapse a shredded variant array by @​nssalian in #​859
• fix(arrow/compute): accept type max value in safe decimal-to-int cast by @​zeroshade in #​862
• chore: Bump github.com/andybalholm/brotli from 1.2.1 to 1.2.2 by @​dependabot[bot] in #​869
• chore: Bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​866
• chore: Bump actions/cache from 5 to 6 by @​dependabot[bot] in #​867
• chore: Bump actions/setup-python from 6.2.0 to 6.3.0 by @​dependabot[bot] in #​868
• fix(array): validate negative bounds in NewSliceData by @​fallintoplace in #​870
• fix(array): dictionary null index zeroing by @​fallintoplace in #​871
• fix(array): struct stringer required child mask by @​fallintoplace in #​873
• fix(array): empty chunked approximate equality by @​fallintoplace in #​874
• fix(array): validate dense union offset lengths by @​fallintoplace in #​875
• Use semantic type equality in AddColumn by @​fallintoplace in #​878
• fix(array): clear dictionary data on reset by @​fallintoplace in #​876
• Reject negative chunked slice bounds by @​fallintoplace in #​879
• fix(array): array data hashing coverage by @​fallintoplace in #​872
• Support dense union slice offsets by @​fallintoplace in #​877
• Support sparse union sliced type ids by @​fallintoplace in #​881
• fix(build): correct phony target declaration by @​fallintoplace in #​890
• fix(parquet/compress): Gzip CompressBound by @​fallintoplace in #​886
• fix(parquet): free excluded stats bytes in ApplyStatSizeLimits by @​mdibaiee in #​885
• fix(tmpl): preserve escaped JSON string bytes by @​fallintoplace in #​889
• fix(parquet/compress): Brotli CompressBound by @​fallintoplace in #​884
• chore: Bump golang.org/x/net from 0.54.0 to 0.55.0 by @​dependabot[bot] in #​893
• fix(parquet): align DataPageV2 pages to row boundaries in spaced writes by @​truffle-dev in #​883
• fix(array): guard BinaryViewBuilder size checks by @​fallintoplace in #​888
• fix: clarify StringViewBuilder UnmarshalJSON error message by @​fallintoplace in #​894
• chore: Bump docker/login-action from 4.2.0 to 4.4.0 by @​dependabot[bot] in #​912
• chore: Bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @​dependabot[bot] in #​915
• chore: Bump github.com/klauspost/cpuid/v2 from 2.3.0 to 2.4.0 by @​dependabot[bot] in #​914
• fix: clarify StringViewBuilder.UnmarshalOne expected type by @​fallintoplace in #​897
• chore: Bump github.com/klauspost/compress from 1.18.6 to 1.19.0 by @​dependabot[bot] in #​913
• fix: guard multiBufferBuilder UnsafeAppend against short copy by @​fallintoplace in #​896
• fix(array): make SetNull idempotent and track null count by @​fallintoplace in #​905
• fix(ci): accept --json and pin gobenchdata by @​fallintoplace in #​906
• build: verify Apache RAT jar checksum before execution by @​fallintoplace in #​908
• fix(parquet): read full bloom filter buffers by @​fallintoplace in #​892
• fix(docs): fix CPU markdown link in README by @​fallintoplace in #​907
• fix(parquet): validate DataPageV2 decoded length by @​fallintoplace in #​911
• fix(arreflect): validate primitive conversion assignment overflow checks by @​fallintoplace in #​903
• fix(parquet): clamp repLevels in byte-array DataPageV2 row-boundary alignment by @​zeroshade in #​919
• fix(parquet/metadata): fix BloomFilter memory recycling, doc contract, and benchmark by @​Patzifist in #​864
• fix(flight/flightsql): recover real error when prepared DoPut stream closes early by @​fornwall in #​920
• fix: guard protobuf oneof/union reflection on nil oneof values by @​fallintoplace in #​910
• fix(parquet): copy ByteArray statistics min/max to prevent use-after-free by @​zeroshade in #​917
• fix(array): bounds check FixedSizeBinary.Value by @​fallintoplace in #​923
• fix(array): reject unsupported type IDs by @​fallintoplace in #​925
• fix(array): validate JSON start offsets by @​fallintoplace in #​929
• fix(scalar): validate dictionary indices before conversion by @​fallintoplace in #​927
• fix(array): retain dictionary before replacement by @​fallintoplace in #​926
• feat(parquet): opt-in streaming reads for large data pages by @​joechenrh in #​880
• chore: Bump golang.org/x/sync from 0.21.0 to 0.22.0 by @​dependabot[bot] in #​934
• chore: Bump github.com/apache/thrift from 0.22.0 to 0.24.0 by @​dependabot[bot] in #​932
• chore: Bump golang.org/x/sys from 0.46.0 to 0.47.0 by @​dependabot[bot] in #​933
• fix(parquet): propagate row-group and page-index write errors by @​fallintoplace in #​921
• fix(array): honor struct offsets in constructors and validity masks by @​fallintoplace in #​922
• fix(parquet): make column reader cleanup idempotent by @​fallintoplace in #​924
• fix(scalar): hash list values logically by @​fallintoplace in #​928
• fix(array): recursively validate nested

✂ Note

PR body was truncated to here.