Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependencies to clear CVEs #185

Closed
randomvariable opened this issue Dec 2, 2022 · 0 comments · Fixed by #187
Closed

Update dependencies to clear CVEs #185

randomvariable opened this issue Dec 2, 2022 · 0 comments · Fixed by #187
Labels
bug Something isn't working

Comments

@randomvariable
Copy link

What happened:

These CVEs are low severity in terms of impact, but customers do run scans on these images and will raise support requests:


go.mod (gomod)
==============
Total: 4 (HIGH: 4)

┌─────────────────────────────┬────────────────┬──────────┬───────────────────────────────────┬───────────────────────────────────┬─────────────────────────────────────────────────────────────┐
│           Library           │ Vulnerability  │ Severity │         Installed Version         │           Fixed Version           │                            Title                            │
├─────────────────────────────┼────────────────┼──────────┼───────────────────────────────────┼───────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ github.com/dgrijalva/jwt-go │ CVE-2020-26160 │ HIGH     │ 3.2.0+incompatible                │                                   │ jwt-go: access restriction bypass vulnerability             │
│                             │                │          │                                   │                                   │ https://avd.aquasec.com/nvd/cve-2020-26160                  │
├─────────────────────────────┼────────────────┤          ├───────────────────────────────────┼───────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/net            │ CVE-2022-27664 │          │ 0.0.0-20220617184016-355a448f1bc9 │ 0.0.0-20220906165146-f3363e06e74c │ golang: net/http: handle server errors after sending GOAWAY │
│                             │                │          │                                   │                                   │ https://avd.aquasec.com/nvd/cve-2022-27664                  │
├─────────────────────────────┼────────────────┤          ├───────────────────────────────────┼───────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/text           │ CVE-2022-32149 │          │ 0.3.7                             │ 0.3.8                             │ golang: golang.org/x/text/language: ParseAcceptLanguage     │
│                             │                │          │                                   │                                   │ takes a long time to parse complex tags                     │
│                             │                │          │                                   │                                   │ https://avd.aquasec.com/nvd/cve-2022-32149                  │
├─────────────────────────────┼────────────────┤          ├───────────────────────────────────┼───────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ gopkg.in/yaml.v3            │ CVE-2022-28948 │          │ 3.0.0                             │ 3.0.1                             │ golang-gopkg-yaml: crash when attempting to deserialize     │
│                             │                │          │                                   │                                   │ invalid input                                               │
│                             │                │          │                                   │                                   │ https://avd.aquasec.com/nvd/cve-2022-28948                  │
└─────────────────────────────┴────────────────┴──────────┴───────────────────────────────────┴───────────────────────────────────┴─────────────────────────────────────────────────────────────┘

In general, bumping to the latest /x packages is recommended.

Anything else we need to know?:

Environment:

  • CAPOCI version: main branch.
  • Cluster-API version (use clusterctl version): N/A
  • Kubernetes version (use kubectl version): N/A
  • Docker version (use docker info): N/A
  • OS (e.g. from /etc/os-release): N/A
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant