Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update module versions to address issues identified by govulncheck #1186

Merged
merged 2 commits into from
Jan 23, 2024

Conversation

staheri14
Copy link
Contributor

This PR addresses the vulnerabilities identified by govulncheck in PR #1179. It upgrades the affected modules to the versions recommended by govulncheck.

Vulnerability #1: GO-2024-2466
    Denial of service in github.com/go-git/go-git/v5 and
    gopkg.in/src-d/go-git.v4
  More info: https://pkg.go.dev/vuln/GO-2024-2466
  Module: github.com/go-git/go-git/v5
    Found in: github.com/go-git/go-git/v5@v5.5.1
    Fixed in: github.com/go-git/go-git/v5@v5.11.0
    Example traces found:
Error:       #1: test/e2e/generator/generate.go:402:36: generator.gitRepoLatestReleaseVersion calls git.PlainOpenWithOptions, which calls filesystem.NewStorage
Error:       #2: test/e2e/generator/generate.go:402:36: generator.gitRepoLatestReleaseVersion calls git.PlainOpenWithOptions
Error:       #3: test/e2e/generator/generate.go:407:30: generator.gitRepoLatestReleaseVersion calls git.Repository.TagObjects

Vulnerability #2: GO-2024-2456
    Path traversal and RCE in github.com/go-git/go-git/v5 and
    gopkg.in/src-d/go-git.v4
  More info: https://pkg.go.dev/vuln/GO-2024-2456
  Module: github.com/go-git/go-git/v5
    Found in: github.com/go-git/go-git/v5@v5.5.1
    Fixed in: github.com/go-git/go-git/v5@v5.11.0
    Example traces found:
Error:       #1: test/e2e/generator/generate.go:402:36: generator.gitRepoLatestReleaseVersion calls git.PlainOpenWithOptions, which calls filesystem.NewStorage
Error:       #2: test/e2e/generator/generate.go:402:36: generator.gitRepoLatestReleaseVersion calls git.PlainOpenWithOptions
Error:       #3: test/e2e/generator/generate.go:407:30: generator.gitRepoLatestReleaseVersion calls git.Repository.TagObjects

=== Informational ===

There are 2 vulnerabilities in modules that you require that are
neither imported nor called. You may not need to take any action.
See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck for details.

Vulnerability #1: GO-2024-2453
    Timing side channel in github.com/cloudflare/circl
  More info: https://pkg.go.dev/vuln/GO-2024-2453
  Module: github.com/cloudflare/circl
    Found in: github.com/cloudflare/circl@v1.3.1
    Fixed in: github.com/cloudflare/circl@v1.3.7

Vulnerability #2: GO-2023-[17](https://github.com/celestiaorg/celestia-core/actions/runs/7629759074/job/20786518441?pr=1179#step:5:18)65
    Leaked shared secret and weak blinding in github.com/cloudflare/circl
  More info: https://pkg.go.dev/vuln/GO-[20](https://github.com/celestiaorg/celestia-core/actions/runs/7629759074/job/20786518441?pr=1179#step:5:21)23-1765
  Module: github.com/cloudflare/circl
    Found in: github.com/cloudflare/circl@v1.3.1
    Fixed in: github.com/cloudflare/circl@v1.3.3

Your code is affected by 2 vulnerabilities from 1 module.

Share feedback at https://go.dev/s/govulncheck-feedback.
exit status 3
make: *** [Makefile:254: vulncheck] Error 1
Error: Process completed with exit code 2.

@staheri14 staheri14 marked this pull request as ready for review January 23, 2024 20:17
@staheri14 staheri14 merged commit 7673ee0 into main Jan 23, 2024
18 checks passed
@staheri14 staheri14 deleted the sanaz/fix-govuln-checks branch January 23, 2024 21:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants