OCPBUGS-93597: Bump golang.org/x/crypto to v0.52.0

[aroyoredhat]

Summary

• Bumps golang.org/x/crypto from v0.51.0 to v0.52.0
• Fixes CVE-2026-39835: Denial of Service via crafted SSH certificate in golang.org/x/crypto/ssh
• SSH servers using CertChecker without setting IsUserAuthority or IsHostAuthority could panic when a client presents a certificate

Impact Analysis

Both affected components (Cinder CSI driver and Manila CSI driver) were analyzed and classified as LOW RISK — the vulnerable CertChecker functions are not called by either component. This update is for compliance.

• OCPBUGS-93618: openshift5/ose-openstack-cinder-csi-driver-rhel9
• OCPBUGS-93597: openshift5/ose-csi-driver-manila-rhel9

Changes

go get golang.org/x/crypto@v0.52.0
go mod tidy
go mod vendor

Test plan

• CI passes (build + unit tests)
• Verify govulncheck ./... no longer reports GO-2026-5015

Made with Cursor

Summary by CodeRabbit

• Chores
  • Updated an underlying security-related dependency to a newer version.

[openshift-ci-robot]

@aroyoredhat: This pull request references Jira Issue OCPBUGS-93618, which is invalid:

• expected the bug to be open, but it isn't
• expected the bug to be in one of the following states: NEW, ASSIGNED, POST, but it is Closed (Not a Bug) instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-93597, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Bumps golang.org/x/crypto from v0.51.0 to v0.52.0
• Fixes CVE-2026-39835: Denial of Service via crafted SSH certificate in golang.org/x/crypto/ssh
• SSH servers using CertChecker without setting IsUserAuthority or IsHostAuthority could panic when a client presents a certificate

Impact Analysis

Both affected components (Cinder CSI driver and Manila CSI driver) were analyzed and classified as LOW RISK — the vulnerable CertChecker functions are not called by either component. This update is for compliance.

• OCPBUGS-93618: openshift5/ose-openstack-cinder-csi-driver-rhel9
• OCPBUGS-93597: openshift5/ose-csi-driver-manila-rhel9

Changes

go get golang.org/x/crypto@v0.52.0
go mod tidy
go mod vendor

Test plan

• CI passes (build + unit tests)
• Verify govulncheck ./... no longer reports GO-2026-5015

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The indirect golang.org/x/crypto dependency in go.mod is upgraded from v0.51.0 to v0.52.0.

Changes

Crypto dependency update

Layer / File(s)	Summary
Update crypto module version go.mod	The indirect golang.org/x/crypto requirement is updated from v0.51.0 to v0.52.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related issues

• openshift/oc-mirror issue 1330 — Concerns upgrading golang.org/x/crypto to the security-fixed v0.52.0.
• openshift/oauth-server issue 206 — Tracks a matching golang.org/x/crypto dependency upgrade.
• openshift/image-based-install-operator issue 443 — Concerns upgrading golang.org/x/crypto to v0.52.0.
• openshift/assisted-installer issue 1404 — Directly concerns updating golang.org/x/crypto.
• openshift/cluster-api-provider-ibmcloud issue 141 — Tracks the same dependency upgrade to v0.52.0.
• openshift/installer issue 10170 — Concerns upgrading golang.org/x/crypto to address security vulnerabilities.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR only bumps x/crypto and updates vendor files; no test files or Ginkgo titles were added or changed.
Test Structure And Quality	✅ Passed	No test files changed; this PR only bumps vendored x/crypto and go.mod/sum, so the Ginkgo test-quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; this PR only bumps x/crypto and updates vendored code.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; this PR only bumps x/crypto and updates vendored library code, so SNO assumptions aren’t implicated.
Topology-Aware Scheduling Compatibility	✅ Passed	Only go.mod/go.sum and vendored golang.org/x/crypto files changed; no deployment manifests, operators, or controllers were modified.
Ote Binary Stdout Contract	✅ Passed	Only go.mod/go.sum and vendored x/crypto SSH code changed; no main/init/TestMain/BeforeSuite stdout writes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Diff only bumps vendored crypto deps; no *_test.go/e2e files or Ginkgo It/Describe/Context/When additions were introduced.
No-Weak-Crypto	✅ Passed	PR only bumps x/crypto and adds SSH certificate checks; no new MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons appear in the diff.
Container-Privileges	✅ Passed	PR only bumps vendored x/crypto and go.mod/sum; no container/K8s manifests changed, so no new privileged/root settings were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	PR only bumps vendored x/crypto and adds validation; no new or modified logging statements expose passwords, tokens, PII, hostnames, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency version bump in the pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: aroyoredhat
Once this PR has been reviewed and has the lgtm label, please assign mdbooth for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[aroyoredhat]

/jira refresh

[openshift-ci-robot]

@aroyoredhat: This pull request references Jira Issue OCPBUGS-93597, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Bumps golang.org/x/crypto from v0.51.0 to v0.52.0
• Fixes CVE-2026-39835: Denial of Service via crafted SSH certificate in golang.org/x/crypto/ssh
• SSH servers using CertChecker without setting IsUserAuthority or IsHostAuthority could panic when a client presents a certificate

Impact Analysis

Both affected components (Cinder CSI driver and Manila CSI driver) were analyzed and classified as LOW RISK — the vulnerable CertChecker functions are not called by either component. This update is for compliance.

• OCPBUGS-93618: openshift5/ose-openstack-cinder-csi-driver-rhel9
• OCPBUGS-93597: openshift5/ose-csi-driver-manila-rhel9

Changes

go get golang.org/x/crypto@v0.52.0
go mod tidy
go mod vendor

Test plan

• CI passes (build + unit tests)
• Verify govulncheck ./... no longer reports GO-2026-5015

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@aroyoredhat: This pull request references Jira Issue OCPBUGS-93597, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (ocp-sustaining-admins@redhat.com), skipping review request.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@aroyoredhat: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	de26e6f	link	false	/test security

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[aroyoredhat]

/cc @openshift/cloud-provider-openstack-approvers

[aroyoredhat]

/verified by ci

[openshift-ci-robot]

@aroyoredhat: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@aroyoredhat: GitHub didn't allow me to request PR reviews from the following users: openshift/cloud-provider-openstack-approvers.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

/cc @openshift/cloud-provider-openstack-approvers

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[aroyoredhat]

@gryf Can you approve this?