Consensys / web3signer

Web3Signer is an open-source signing service capable of signing on multiple platforms (Ethereum1 and 2, Filecoin) using private keys stored in an external vault, or encrypted on a disk.
https://docs.web3signer.consensys.net/
Apache License 2.0
201 stars 78 forks source link

Upgrade postgres jdbc driver to 42.7.2 #975

Closed usmansaleem closed 9 months ago

usmansaleem commented 9 months ago

PR Description

Upgrade postgres jdbc driver to 42.7.2. Addresses CVE-2024-1597

Fixed Issue(s)

Documentation

Changelog

Testing

usmansaleem commented 9 months ago
 trivy image consensys/web3signer:develop --exit-code 1 --severity HIGH,CRITICAL --ignorefile "gradle/trivyignore.txt" --timeout 10m
2024-02-27T09:59:26.474+1000    INFO    Need to update DB
2024-02-27T09:59:26.474+1000    INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2024-02-27T09:59:26.474+1000    INFO    Downloading DB...
43.23 MiB / 43.23 MiB [---------------------------------------------------------------------] 100.00% 8.91 MiB p/s 5.1s
2024-02-27T09:59:33.215+1000    INFO    Vulnerability scanning is enabled
2024-02-27T09:59:33.215+1000    INFO    Secret scanning is enabled
2024-02-27T09:59:33.215+1000    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-02-27T09:59:33.215+1000    INFO    Please see also https://aquasecurity.github.io/trivy/v0.49/docs/scanner/secret/#recommendation for faster secret detection
2024-02-27T09:59:37.906+1000    INFO    Java DB Repository: ghcr.io/aquasecurity/trivy-java-db:1
2024-02-27T09:59:37.906+1000    INFO    Downloading the Java DB...
507.19 MiB / 507.19 MiB [-------------------------------------------------------------------] 100.00% 15.21 MiB p/s 34s
2024-02-27T10:00:12.923+1000    INFO    The Java DB is cached for 3 days. If you want to update the database more frequently, the '--reset' flag clears the DB cache.
2024-02-27T10:00:13.080+1000    INFO    Detected OS: ubuntu
2024-02-27T10:00:13.080+1000    INFO    Detecting Ubuntu vulnerabilities...
2024-02-27T10:00:13.084+1000    INFO    Number of language-specific files: 1
2024-02-27T10:00:13.084+1000    INFO    Detecting jar vulnerabilities...

consensys/web3signer:develop (ubuntu 22.04)

Total: 0 (HIGH: 0, CRITICAL: 0)
usmansaleem commented 9 months ago
./gradlew --no-daemon -Dorg.gradle.parallel=false dependencyCheckAggregate -DnvdApiDelay=6000
<snip>
BUILD SUCCESSFUL in 2m 10s
10 actionable tasks: 10 executed