Skip to content

Conversation

mvasl
Copy link
Member

@mvasl mvasl commented Sep 27, 2024

This PR updates golang version to latest 1.23 patch and fixes the folloving vulnerabilities

┌────────────────────────────────┬────────────────┬──────────┬────────┬──────────────────────┬─────────────────────────────────┬─────────────────────────────────────────────────────────────┐
│            Library             │ Vulnerability  │ Severity │ Status │  Installed Version   │          Fixed Version          │                            Title                            │
├────────────────────────────────┼────────────────┼──────────┼────────┼──────────────────────┼─────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ github.com/docker/docker       │ CVE-2024-41110 │ CRITICAL │ fixed  │ v25.0.5+incompatible │ 23.0.15, 26.1.5, 27.1.1, 25.0.6 │ moby: Authz zero length regression                          │
│                                │                │          │        │                      │                                 │ https://avd.aquasec.com/nvd/cve-2024-41110                  │
├────────────────────────────────┼────────────────┼──────────┤        ├──────────────────────┼─────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ github.com/opencontainers/runc │ CVE-2024-45310 │ LOW      │        │ v1.1.12              │ 1.1.14, 1.2.0-rc.3              │ runc: runc can be tricked into creating empty               │
│                                │                │          │        │                      │                                 │ files/directories on host                                   │
│                                │                │          │        │                      │                                 │ https://avd.aquasec.com/nvd/cve-2024-45310                  │
├────────────────────────────────┼────────────────┼──────────┤        ├──────────────────────┼─────────────────────────────────┼─────────────────────────────────────────────────────────────┤
│ stdlib                         │ CVE-2024-34156 │ HIGH     │        │ 1.22.6               │ 1.22.7, 1.23.1                  │ encoding/gob: golang: Calling Decoder.Decode on a message   │
│                                │                │          │        │                      │                                 │ which contains deeply nested structures...                  │
│                                │                │          │        │                      │                                 │ https://avd.aquasec.com/nvd/cve-2024-34156                  │
│                                ├────────────────┼──────────┤        │                      │                                 ├─────────────────────────────────────────────────────────────┤
│                                │ CVE-2024-34155 │ MEDIUM   │        │                      │                                 │ go/parser: golang: Calling any of the Parse functions       │
│                                │                │          │        │                      │                                 │ containing deeply nested literals...                        │
│                                │                │          │        │                      │                                 │ https://avd.aquasec.com/nvd/cve-2024-34155                  │
│                                ├────────────────┤          │        │                      │                                 ├─────────────────────────────────────────────────────────────┤
│                                │ CVE-2024-34158 │          │        │                      │                                 │ go/build/constraint: golang: Calling Parse on a "// +build" │
│                                │                │          │        │                      │                                 │ build tag line with...                                      │
│                                │                │          │        │                      │                                 │ https://avd.aquasec.com/nvd/cve-2024-34158                  │
└────────────────────────────────┴────────────────┴──────────┴────────┴──────────────────────┴─────────────────────────────────┴─────────────────────────────────────────────────────────────┘

@mvasl mvasl self-assigned this Sep 27, 2024
@mvasl mvasl merged commit 33e12d9 into main Sep 27, 2024
4 checks passed
@mvasl mvasl deleted the chore/fix-cves branch September 27, 2024 08:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant