search

ForgeRock / secret-agent

Generate random Kubernetes secrets and optionally store them in a Cloud Secret Manager
Apache License 2.0
17 stars 20 forks source link

github.com/go-playground/validator/v10-v10.6.1: 6 vulnerabilities (highest severity is: 7.5) - autoclosed #250

Closed mend-for-github-com[bot] closed 3 months ago

mend-for-github-com[bot] commented 11 months ago
Vulnerable Library - github.com/go-playground/validator/v10-v10.6.1

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/text/@v/v0.3.4.mod

Found in HEAD commit: f72485996d8c18101bbdfdd784accb8cfaded7b2

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (github.com/go-playground/validator/v10-v10.6.1 version) Remediation Possible**
CVE-2022-32149 High 7.5 golang.org/x/text-v0.3.4 Transitive N/A* ❌
CVE-2022-27191 High 7.5 golang.org/x/crypto-v0.0.0-20210220033148-5ea612d1eb83 Transitive N/A* ❌
CVE-2021-43565 High 7.5 golang.org/x/crypto-v0.0.0-20210220033148-5ea612d1eb83 Transitive N/A* ❌
CVE-2021-38561 High 7.5 golang.org/x/text-v0.3.4 Transitive N/A* ❌
CVE-2020-28852 High 7.5 golang.org/x/text-v0.3.4 Transitive N/A* ❌
CVE-2020-28851 High 7.5 golang.org/x/text-v0.3.4 Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-32149 ### Vulnerable Library - golang.org/x/text-v0.3.4

[mirror] Go text processing support

Library home page: https://proxy.golang.org/golang.org/x/text/@v/v0.3.4.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/text/@v/v0.3.4.mod

Dependency Hierarchy: - github.com/go-playground/validator/v10-v10.6.1 (Root Library) - :x: **golang.org/x/text-v0.3.4** (Vulnerable Library)

Found in HEAD commit: f72485996d8c18101bbdfdd784accb8cfaded7b2

Found in base branch: master

### Vulnerability Details

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

Publish Date: 2022-10-14

URL: CVE-2022-32149

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-32149

Release Date: 2022-10-14

Fix Resolution: v0.3.8

CVE-2022-27191 ### Vulnerable Library - golang.org/x/crypto-v0.0.0-20210220033148-5ea612d1eb83

Library home page: https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20210220033148-5ea612d1eb83.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.0.0-20210220033148-5ea612d1eb83.mod

Dependency Hierarchy: - github.com/go-playground/validator/v10-v10.6.1 (Root Library) - :x: **golang.org/x/crypto-v0.0.0-20210220033148-5ea612d1eb83** (Vulnerable Library)

Found in HEAD commit: f72485996d8c18101bbdfdd784accb8cfaded7b2

Found in base branch: master

### Vulnerability Details

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

Publish Date: 2022-03-18

URL: CVE-2022-27191

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-27191

Release Date: 2022-03-18

Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20220315.3147a52-1;golang-go.crypto-dev - 1:0.0~git20220315.3147a52-1

CVE-2021-43565 ### Vulnerable Library - golang.org/x/crypto-v0.0.0-20210220033148-5ea612d1eb83

Library home page: https://proxy.golang.org/golang.org/x/crypto/@v/v0.0.0-20210220033148-5ea612d1eb83.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.0.0-20210220033148-5ea612d1eb83.mod

Dependency Hierarchy: - github.com/go-playground/validator/v10-v10.6.1 (Root Library) - :x: **golang.org/x/crypto-v0.0.0-20210220033148-5ea612d1eb83** (Vulnerable Library)

Found in HEAD commit: f72485996d8c18101bbdfdd784accb8cfaded7b2

Found in base branch: master

### Vulnerability Details

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

Publish Date: 2022-09-06

URL: CVE-2021-43565

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43565

Release Date: 2021-11-10

Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20211202.5770296-1;golang-go.crypto-dev - 1:0.0~git20211202.5770296-1

CVE-2021-38561 ### Vulnerable Library - golang.org/x/text-v0.3.4

[mirror] Go text processing support

Library home page: https://proxy.golang.org/golang.org/x/text/@v/v0.3.4.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/text/@v/v0.3.4.mod

Dependency Hierarchy: - github.com/go-playground/validator/v10-v10.6.1 (Root Library) - :x: **golang.org/x/text-v0.3.4** (Vulnerable Library)

Found in HEAD commit: f72485996d8c18101bbdfdd784accb8cfaded7b2

Found in base branch: master

### Vulnerability Details

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

Publish Date: 2022-12-26

URL: CVE-2021-38561

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2021-0113

Release Date: 2021-08-12

Fix Resolution: v0.3.7

CVE-2020-28852 ### Vulnerable Library - golang.org/x/text-v0.3.4

[mirror] Go text processing support

Library home page: https://proxy.golang.org/golang.org/x/text/@v/v0.3.4.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/text/@v/v0.3.4.mod

Dependency Hierarchy: - github.com/go-playground/validator/v10-v10.6.1 (Root Library) - :x: **golang.org/x/text-v0.3.4** (Vulnerable Library)

Found in HEAD commit: f72485996d8c18101bbdfdd784accb8cfaded7b2

Found in base branch: master

### Vulnerability Details

In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

Publish Date: 2021-01-02

URL: CVE-2020-28852

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-28852

Release Date: 2021-01-02

Fix Resolution: golang-golang-x-text-dev - 0.3.5-1,0.3.5-1

CVE-2020-28851 ### Vulnerable Library - golang.org/x/text-v0.3.4

[mirror] Go text processing support

Library home page: https://proxy.golang.org/golang.org/x/text/@v/v0.3.4.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/text/@v/v0.3.4.mod

Dependency Hierarchy: - github.com/go-playground/validator/v10-v10.6.1 (Root Library) - :x: **golang.org/x/text-v0.3.4** (Vulnerable Library)

Found in HEAD commit: f72485996d8c18101bbdfdd784accb8cfaded7b2

Found in base branch: master

### Vulnerability Details

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

Publish Date: 2021-01-02

URL: CVE-2020-28851

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-28851

Release Date: 2021-01-02

Fix Resolution: golang-golang-x-text-dev - 0.3.6-1,0.3.6-1

mend-for-github-com[bot] commented 6 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-for-github-com[bot] commented 4 months ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.

mend-for-github-com[bot] commented 3 months ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.