OCPBUGS-70835: Mitigate CVE 2025 61729 release 4.19

go.mod

@@ -33,7 +33,7 @@ require (
 	github.com/moby/term v0.5.0
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.0
-	github.com/openshift/api v0.0.0-20250130025500-d9e1a2e1fe6b
+	github.com/openshift/api v0.0.0-20250320170726-75d64d71980b
 	github.com/openshift/build-machinery-go v0.0.0-20250102153059-e85a1a7ecb5c
 	github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7
 	github.com/openshift/library-go v0.0.0-20250218150059-017e5b6cf27c
@@ -195,6 +195,7 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	k8s.io/component-helpers v0.32.1 // indirect
+	k8s.io/kube-aggregator v0.32.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f // indirect
 	k8s.io/metrics v0.32.1 // indirect
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
@@ -206,3 +207,6 @@ require (
 )
 
 replace github.com/apcera/gssapi => github.com/openshift/gssapi v0.0.0-20161010215902-5fb4217df13b
+
+// Branch mitigate-CVE-2025-61729-release-4.19
+replace github.com/openshift/library-go => github.com/tchap/library-go v0.0.0-20260108123746-89915030bc58

go.sum

@@ -489,16 +489,14 @@ github.com/opencontainers/runtime-spec v1.2.0 h1:z97+pHb3uELt/yiAWD691HNHQIF07bE
 github.com/opencontainers/runtime-spec v1.2.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
 github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
-github.com/openshift/api v0.0.0-20250130025500-d9e1a2e1fe6b h1:6OdSvfIgEGZ4Oc4zmhcaCRGWeJHVvHc3fkoRckWYajQ=
-github.com/openshift/api v0.0.0-20250130025500-d9e1a2e1fe6b/go.mod h1:yk60tHAmHhtVpJQo3TwVYq2zpuP70iJIFDCmeKMIzPw=
+github.com/openshift/api v0.0.0-20250320170726-75d64d71980b h1:GGuFSHESP0BSOu70AqV4u9IVrjYdaeu4Id+HXRIOvkw=
+github.com/openshift/api v0.0.0-20250320170726-75d64d71980b/go.mod h1:yk60tHAmHhtVpJQo3TwVYq2zpuP70iJIFDCmeKMIzPw=
 github.com/openshift/build-machinery-go v0.0.0-20250102153059-e85a1a7ecb5c h1:6XcszPFZpan4qll5XbdLll7n1So3IsPn28aw2j1obMo=
 github.com/openshift/build-machinery-go v0.0.0-20250102153059-e85a1a7ecb5c/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE=
 github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7 h1:4iliLcvr1P9EUMZgIaSNEKNQQzBn+L6PSequlFOuB6Q=
 github.com/openshift/client-go v0.0.0-20250125113824-8e1f0b8fa9a7/go.mod h1:2tcufBE4Cu6RNgDCxcUJepa530kGo5GFVfR9BSnndhI=
 github.com/openshift/gssapi v0.0.0-20161010215902-5fb4217df13b h1:it0YPE/evO6/m8t8wxis9KFI2F/aleOKsI6d9uz0cEk=
 github.com/openshift/gssapi v0.0.0-20161010215902-5fb4217df13b/go.mod h1:tNrEB5k8SI+g5kOlsCmL2ELASfpqEofI0+FLBgBdN08=
-github.com/openshift/library-go v0.0.0-20250218150059-017e5b6cf27c h1:lW/rlxNTLYbHBoB9NBLEykzGriHyc/s/52bTQRUgH9U=
-github.com/openshift/library-go v0.0.0-20250218150059-017e5b6cf27c/go.mod h1:GHwvopE5KXXCz4ULHp871sTPLLW+FB+hu/RIzlNwxx8=
 github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
 github.com/pelletier/go-toml v1.7.0/go.mod h1:vwGMzjaWMwyfHwgIBhI2YUM4fB6nL6lVAvS1LBMMhTE=
 github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
@@ -587,6 +585,8 @@ github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOf
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
 github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
+github.com/tchap/library-go v0.0.0-20260108123746-89915030bc58 h1:uza6taICN7yn0ARCaA2mBgBA8wQqiCMdhr4ttLc7T6A=
+github.com/tchap/library-go v0.0.0-20260108123746-89915030bc58/go.mod h1:DAa3BGl0CFtkfJn/g5rU8kDDTErfMVA/QlFm4cvU+MI=
 github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399 h1:e/5i7d4oYZ+C1wj2THlRK+oAhjeS/TRQwMfkIuet3w0=
 github.com/titanous/rocacheck v0.0.0-20171023193734-afe73141d399/go.mod h1:LdwHTNJT99C5fTAzDz0ud328OgXz+gierycbcIx2fRs=
@@ -989,6 +989,8 @@ k8s.io/component-helpers v0.32.1 h1:TwdsSM1vW9GjnfX18lkrZbwE5G9psCIS2/rhenTDXd8=
 k8s.io/component-helpers v0.32.1/go.mod h1:1JT1Ei3FD29yFQ18F3laj1WyvxYdHIhyxx6adKMFQXI=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-aggregator v0.32.1 h1:cztPyIHbo6tgrhYHDqmdmvxUufJKuxgAC/vog7yeWek=
+k8s.io/kube-aggregator v0.32.1/go.mod h1:sXjL5T8FO/rlBzTbBhahw9V5Nnr1UtzZHKTj9WxQCOU=
 k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f h1:GA7//TjRY9yWGy1poLzYYJJ4JRdzg3+O6e8I+e+8T5Y=
 k8s.io/kube-openapi v0.0.0-20241105132330-32ad38e42d3f/go.mod h1:R/HEjbvWI0qdfb8viZUeVZm0X6IZnxAydC7YU42CMw4=
 k8s.io/kubectl v0.32.1 h1:/btLtXLQUU1rWx8AEvX9jrb9LaI6yeezt3sFALhB8M8=

pkg/cli/login/error_translation.go

@@ -5,6 +5,8 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+
+	"github.com/openshift/library-go/pkg/crypto"
 )
 
 const (
@@ -54,6 +56,11 @@ func getPrettyMessageForServer(err error, serverName string) string {
 		return fmt.Sprintf(tlsOversizedRecordMsg, err, serverName)
 
 	case certificateHostnameErrorReason:
+		// Use FormatHostnameError to mitigate CVE-2025-61729.
+		var hostnameErr x509.HostnameError
+		if errors.As(err, &hostnameErr) {
+			return fmt.Sprintf("The server is using a certificate that does not match its hostname: %s", crypto.FormatHostnameError(hostnameErr))
+		}
 		return fmt.Sprintf("The server is using a certificate that does not match its hostname: %s", err)
 
 	case certificateInvalidReason:
@@ -71,12 +78,21 @@ func getPrettyErrorForServer(err error, serverName string) error {
 
 func detectReason(err error) int {
 	if err != nil {
+		// Use FormatHostnameError to mitigate CVE-2025-61729.
+		var errMsg string
+		var hostnameErr x509.HostnameError
+		if errors.As(err, &hostnameErr) {
+			errMsg = crypto.FormatHostnameError(hostnameErr)
+		} else {
+			errMsg = err.Error()
+		}
+
 		switch {
-		case strings.Contains(err.Error(), "certificate signed by unknown authority"):
+		case strings.Contains(errMsg, "certificate signed by unknown authority"):
 			return certificateAuthorityUnknownReason
-		case strings.Contains(err.Error(), "no server defined"):
+		case strings.Contains(errMsg, "no server defined"):
 			return noServerFoundReason
-		case strings.Contains(err.Error(), "tls: oversized record received"):
+		case strings.Contains(errMsg, "tls: oversized record received"):
 			return tlsOversizedRecordReason
 		}
 		switch err.(type) {

pkg/cli/login/helpers.go

@@ -10,6 +10,7 @@ import (
 	"os"
 	"strings"
 
+	"github.com/openshift/library-go/pkg/crypto"
 	"github.com/openshift/oc/pkg/helpers/term"
 	"k8s.io/apimachinery/pkg/util/sets"
 	"k8s.io/cli-runtime/pkg/printers"
@@ -87,11 +88,12 @@ func dialToServer(clientConfig restclient.Config) error {
 func promptForInsecureTLS(reader io.Reader, out io.Writer, reason error) bool {
 	var insecureTLSRequestReason string
 	if reason != nil {
-		switch reason.(type) {
+		switch reason := reason.(type) {
 		case x509.UnknownAuthorityError:
 			insecureTLSRequestReason = "The server uses a certificate signed by an unknown authority."
 		case x509.HostnameError:
-			insecureTLSRequestReason = fmt.Sprintf("The server is using a certificate that does not match its hostname: %s", reason.Error())
+			// Use FormatHostnameError to mitigate CVE-2025-61729.q
+			insecureTLSRequestReason = fmt.Sprintf("The server is using a certificate that does not match its hostname: %s", crypto.FormatHostnameError(reason))
 		case x509.CertificateInvalidError:
 			insecureTLSRequestReason = fmt.Sprintf("The server is using an invalid certificate: %s", reason.Error())
 		}