CVE-2021-3121 - gogo/protobuf

[anshulahuja98]

What steps did you take and what happened:

Our component governance tool is flagging gogo/protobuf (1.1.1, 1.2.1, 1.3.1) due to the CVE-2021-3121

CVE Description: An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

Currently in go.sum: it is present at following place: https://github.com/vmware-tanzu/velero/blob/de83980a05059f0e41ed00f1cf0ef061a9ebc049/go.sum#L297C1-L299C87

We fixed it for some of our repos by adding the following redirect in go.mod

replace github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.2

Vote on this issue!

This is an invitation to the Velero community to vote on issues, you can see the project's top voted issues listed here.
Use the "reaction smiley face" up to the right of this comment to vote.

• 👍 for "I would like to see this bug fixed as soon as possible"
• 👎 for "There are more important bugs to focus on right now"

[sseago]

This seems to be a false positive. As of go 1.17, all direct and indirect dependencies are included in go.mod. go.sum lists every dependency of every package prior to package version resolution, so multiple versions can be listed. Only one version of a package will be built, though, and that version should be specified in go.mod:

$ grep gogo go.mod 
	github.com/gogo/protobuf v1.3.2 // indirect

Also, go list -m all will list all modules for the build list, again only the (fixed) version is included:

$ go list -m all|grep gogo
github.com/gogo/protobuf v1.3.2

I also confirmed this by running go mod vendor locally:

$ grep gogo vendor/modules.txt 
# github.com/gogo/protobuf v1.3.2
github.com/gogo/protobuf/proto
github.com/gogo/protobuf/sortkeys

Note that Dependabot has stopped using go.sum for vulnerability scanning as well: https://github.blog/changelog/2023-03-07-dependency-graph-removes-go-sum-support/

[sseago]

Also, if you check PR/issue history, we fixed this CVE a while back, which is why the currently-included package for the build is the fixed version. I'd rather avoid replace directives when they're unnecessary as then later if a package requires a newer version of this package, the replace becomes a forced downgrade, which could introduce unexpected behavior or bugs.

[anshulahuja98]

Thank you for explaining this in detail! We will check with our scanning tools.

[blackpiglet]

Close for now.