k3s/1.29.3-r1: cve remediation

[octo-sts]

k3s/1.29.3-r1: fix GHSA-c33x-xqrf-c478

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/k3s.advisories.yaml

[github-actions]

Package k3s: Click to expand/collapse

Package k3s:
Modified: /bin/_k3s-inner
Modified: /bin/k3s

Package k3s-images: Click to expand/collapse

Package k3s-images:
Modified: /var/lib/rancher/k3s/agent/images/k3s-airgap-images-amd64.tar

bincapz found differences: Click to expand/collapse

Changed: k3s/bin/k3s

RISK	KEY	DESCRIPTION
+2/MEDIUM	kernel/apparmor	apparmor
+2/MEDIUM	process/chdir	changes current working directory: "cd yO"
+1/LOW	kernel/seccomp	operate on Secure Computing state of the process

Changed: k3s/bin/_k3s-inner

RISK	KEY	DESCRIPTION
-2/MEDIUM	net/vnc	vnc user
+2/MEDIUM	process/chdir	changes current working directory: "cd"

[github-actions]

Package k3s: Click to expand/collapse

Package k3s:
Modified: /bin/_k3s-inner
Modified: /bin/k3s

Package k3s-images: Click to expand/collapse

Package k3s-images:
Modified: /var/lib/rancher/k3s/agent/images/k3s-airgap-images-amd64.tar

bincapz found differences: Click to expand/collapse

Changed: k3s/bin/k3s

RISK	KEY	DESCRIPTION
+2/MEDIUM	kernel/apparmor	apparmor
+2/MEDIUM	net/bpf	bPF (Berkeley Packet Filter)
+1/LOW	kernel/seccomp	operate on Secure Computing state of the process

Changed: k3s/bin/_k3s-inner

RISK	KEY	DESCRIPTION
-2/MEDIUM	net/vnc	vnc user
+2/MEDIUM	process/chdir	changes current working directory: "cd"

[vaikas]

Just curious if we need something else in our gobump so that we wouldn't need to do both bump, and patch the go files too. Having the patch file, I would assume will be harder to know when / how to remove old patches?

[hectorj2f]

@vaikas The patch is used whenever we need to make some code changes. We could remove go.mod/sum files from the patch. However whenever there is an update, gobump unnecessary changes will be wiped out from the definition.

Regarding the patch, I am sure our update bot does not check if it is needed anymore.

[vaikas]

Yeah, that makes sense about the code changes, and I was indeed only wondering about the go.sum/go.mod patches.