-
Notifications
You must be signed in to change notification settings - Fork 34
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Dependency Dashboard #4
Comments
d-loose
added a commit
that referenced
this issue
Jan 28, 2025
Needed to fix two vulnerabilities: ``` Vulnerability #1: GO-2025-3420 Sensitive headers incorrectly sent after cross-domain redirect in net/http More info: https://pkg.go.dev/vuln/GO-2025-3420 Standard library Found in: net/http@go1.22.5 Fixed in: net/http@go1.22.11 Example traces found: #1: internal/services/telemetry/telemetry.go:38:31: telemetry.sysmetricsImpl.SendDecline calls sysmetrics.SendDecline, which eventually calls http.Client.Do Vulnerability #2: GO-2025-3373 Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2025-3373 Standard library Found in: crypto/x509@go1.22.5 Fixed in: crypto/x509@go1.22.11 Example traces found: #1: internal/testutils/systembus.go:35:10: testutils.StartLocalSystemBus calls sync.Once.Do, which eventually calls x509.CertPool.AppendCertsFromPEM #2: cmd/provd/daemon/daemon_test.go:224:18: daemon_test.TestAppCanSigHupWithoutExecute calls io.Copy, which eventually calls x509.Certificate.Verify #3: cmd/provd/daemon/daemon_test.go:224:18: daemon_test.TestAppCanSigHupWithoutExecute calls io.Copy, which eventually calls x509.Certificate.VerifyHostname #4: cmd/provd/daemon/daemon_test.go:449:25: daemon_test.TestMain calls fmt.Sprintf, which eventually calls x509.HostnameError.Error #5: internal/testutils/systembus.go:35:10: testutils.StartLocalSystemBus calls sync.Once.Do, which eventually calls x509.ParseCertificate ```
d-loose
added a commit
that referenced
this issue
Jan 28, 2025
Needed to fix two vulnerabilities: ``` Vulnerability #1: GO-2025-3420 Sensitive headers incorrectly sent after cross-domain redirect in net/http More info: https://pkg.go.dev/vuln/GO-2025-3420 Standard library Found in: net/http@go1.22.5 Fixed in: net/http@go1.22.11 Example traces found: #1: internal/services/telemetry/telemetry.go:38:31: telemetry.sysmetricsImpl.SendDecline calls sysmetrics.SendDecline, which eventually calls http.Client.Do Vulnerability #2: GO-2025-3373 Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2025-3373 Standard library Found in: crypto/x509@go1.22.5 Fixed in: crypto/x509@go1.22.11 Example traces found: #1: internal/testutils/systembus.go:35:10: testutils.StartLocalSystemBus calls sync.Once.Do, which eventually calls x509.CertPool.AppendCertsFromPEM #2: cmd/provd/daemon/daemon_test.go:224:18: daemon_test.TestAppCanSigHupWithoutExecute calls io.Copy, which eventually calls x509.Certificate.Verify #3: cmd/provd/daemon/daemon_test.go:224:18: daemon_test.TestAppCanSigHupWithoutExecute calls io.Copy, which eventually calls x509.Certificate.VerifyHostname #4: cmd/provd/daemon/daemon_test.go:449:25: daemon_test.TestMain calls fmt.Sprintf, which eventually calls x509.HostnameError.Error #5: internal/testutils/systembus.go:35:10: testutils.StartLocalSystemBus calls sync.Once.Do, which eventually calls x509.ParseCertificate ```
d-loose
added a commit
that referenced
this issue
Jan 28, 2025
Needed to fix two vulnerabilities: ``` Vulnerability #1: GO-2025-3420 Sensitive headers incorrectly sent after cross-domain redirect in net/http More info: https://pkg.go.dev/vuln/GO-2025-3420 Standard library Found in: net/http@go1.22.5 Fixed in: net/http@go1.22.11 Example traces found: #1: internal/services/telemetry/telemetry.go:38:31: telemetry.sysmetricsImpl.SendDecline calls sysmetrics.SendDecline, which eventually calls http.Client.Do Vulnerability #2: GO-2025-3373 Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2025-3373 Standard library Found in: crypto/x509@go1.22.5 Fixed in: crypto/x509@go1.22.11 Example traces found: #1: internal/testutils/systembus.go:35:10: testutils.StartLocalSystemBus calls sync.Once.Do, which eventually calls x509.CertPool.AppendCertsFromPEM #2: cmd/provd/daemon/daemon_test.go:224:18: daemon_test.TestAppCanSigHupWithoutExecute calls io.Copy, which eventually calls x509.Certificate.Verify #3: cmd/provd/daemon/daemon_test.go:224:18: daemon_test.TestAppCanSigHupWithoutExecute calls io.Copy, which eventually calls x509.Certificate.VerifyHostname #4: cmd/provd/daemon/daemon_test.go:449:25: daemon_test.TestMain calls fmt.Sprintf, which eventually calls x509.HostnameError.Error #5: internal/testutils/systembus.go:35:10: testutils.StartLocalSystemBus calls sync.Once.Do, which eventually calls x509.ParseCertificate ```
d-loose
added a commit
that referenced
this issue
Jan 28, 2025
Needed to fix two vulnerabilities: ``` Vulnerability #1: GO-2025-3420 Sensitive headers incorrectly sent after cross-domain redirect in net/http More info: https://pkg.go.dev/vuln/GO-2025-3420 Standard library Found in: net/http@go1.22.5 Fixed in: net/http@go1.22.11 Example traces found: #1: internal/services/telemetry/telemetry.go:38:31: telemetry.sysmetricsImpl.SendDecline calls sysmetrics.SendDecline, which eventually calls http.Client.Do Vulnerability #2: GO-2025-3373 Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509 More info: https://pkg.go.dev/vuln/GO-2025-3373 Standard library Found in: crypto/x509@go1.22.5 Fixed in: crypto/x509@go1.22.11 Example traces found: #1: internal/testutils/systembus.go:35:10: testutils.StartLocalSystemBus calls sync.Once.Do, which eventually calls x509.CertPool.AppendCertsFromPEM #2: cmd/provd/daemon/daemon_test.go:224:18: daemon_test.TestAppCanSigHupWithoutExecute calls io.Copy, which eventually calls x509.Certificate.Verify #3: cmd/provd/daemon/daemon_test.go:224:18: daemon_test.TestAppCanSigHupWithoutExecute calls io.Copy, which eventually calls x509.Certificate.VerifyHostname #4: cmd/provd/daemon/daemon_test.go:449:25: daemon_test.TestMain calls fmt.Sprintf, which eventually calls x509.HostnameError.Error #5: internal/testutils/systembus.go:35:10: testutils.StartLocalSystemBus calls sync.Once.Do, which eventually calls x509.ParseCertificate ```
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
None yet
0 participants
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
Awaiting Schedule
These updates are awaiting their schedule. Click on a checkbox to get an update now.
Warning
Renovate failed to look up the following dependencies:
Failed to look up dart package ubuntu_utils
,Failed to look up dart package ubuntu_wizard
,Failed to look up dart package landscape_client
,Failed to look up dart package subiquity_client
,Failed to look up dart package timezone_map
,Failed to look up dart package ubuntu_provision
,Failed to look up dart package subiquity_test
,Failed to look up dart package ubuntu_provision_test
,Failed to look up dart package provd_client
,Failed to look up dart package ubuntu_bootstrap
,Failed to look up dart package ubuntu_init
.Files affected:
apps/factory_reset_tools/pubspec.yaml
,apps/ubuntu_bootstrap/pubspec.yaml
,apps/ubuntu_init/pubspec.yaml
,packages/subiquity_test/pubspec.yaml
,packages/ubuntu_provision/pubspec.yaml
,packages/ubuntu_provision_test/pubspec.yaml
,packages/ubuntu_utils/pubspec.yaml
Open
These updates have all been created already. Click a checkbox below to force a retry/rebase of any.
Detected dependencies
git-submodules
github-actions
gomod
pub
The text was updated successfully, but these errors were encountered: