Skip to content

fix: pin openvsx public URL to mitigate CVE-2025-12999 - #2245

Merged
svor merged 2 commits into
7.123.xfrom
sv-CVE-2025-12999-7.123.x
Oct 28, 2026
Merged

fix: pin openvsx public URL to mitigate CVE-2025-12999#2245
svor merged 2 commits into
7.123.xfrom
sv-CVE-2025-12999-7.123.x

Conversation

@svor

@svor svor commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

backport #2244 and #2235

Screenshot/screencast of this PR

What issues does this PR fix or reference?

https://redhat.atlassian.net/browse/CRW-13930

How to test this PR?

  1. Deploy the operator:

OpenShift

build/scripts/oc-tests/oc-test.sh --install-from pr

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh

Common Test Scenarios

  • Deploy Eclipse Che
  • Start an empty workspace
  • Open terminal and build/run an image
  • Stop a workspace
  • Check operator logs for reconciliation errors or infinite reconciliation loops

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

@svor
chore: bump ovenvsx to v1.3.0 (#2235)
62e8e6f 
* chore: bump ovenvsx to v1.3.0

Signed-off-by: Valerii Svydenko <vsvydenk@redhat.com>

* update dev resources

Signed-off-by: Valerii Svydenko <vsvydenk@redhat.com>

---------

Signed-off-by: Valerii Svydenko <vsvydenk@redhat.com>
@coderabbitai

coderabbitai Bot commented Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 4b018a3c-ea1c-418c-b0e9-f7692223eab6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@svor @claude
fix: pin openvsx public URL to mitigate CVE-2025-12999 (#2244)
41ecd91 
Set ovsx.server.url via OVSX_SERVER_URL env var so OpenVSX builds
absolute URLs from the configured Che host instead of resolving them
from X-Forwarded-Host. This eliminates the HTTP cache-poisoning vector
(GHSA-f55q-5m46-rmxc) for in-cluster clients that bypass HAProxy.

Also switch forward-headers-strategy to 'none': the native strategy lets
Jetty rewrite remoteAddr from X-Forwarded-For at the connector level,
before OpenVSX's TrustedForwardedHeaderFilter runs, causing the filter
to evaluate the end client IP instead of the gateway — defeating the
trusted-proxy check.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
@svor
svor force-pushed the sv-CVE-2025-12999-7.123.x branch from b9a2956 to 41ecd91 Compare October 27, 2026 15:03
@openshift-ci

openshift-ci Bot commented Oct 27, 2026

Copy link
Copy Markdown

@svor: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/v22-che-operator-update 41ecd91 link true /test v22-che-operator-update
ci/prow/v22-devworkspace-happy-path 41ecd91 link true /test v22-devworkspace-happy-path

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@openshift-ci openshift-ci Bot added the lgtm label Oct 28, 2026
@openshift-ci

openshift-ci Bot commented Oct 28, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: svor, tolusha

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@svor
svor merged commit 833f185 into 7.123.x Oct 28, 2026
15 of 17 checks passed
@svor
svor deleted the sv-CVE-2025-12999-7.123.x branch October 28, 2026 11:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tolusha tolusha tolusha approved these changes
@SDawley SDawley Awaiting requested review from SDawley SDawley is a code owner
@ibuziuk ibuziuk Awaiting requested review from ibuziuk ibuziuk is a code owner
@mkuznyetsov mkuznyetsov Awaiting requested review from mkuznyetsov mkuznyetsov is a code owner
@dkwon17 dkwon17 Awaiting requested review from dkwon17 dkwon17 is a code owner

Assignees

@tolusha tolusha

Labels

lgtm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@svor @tolusha