search

aelsabbahy / goss-docker

Easy docker health checks, /healthz endpoints, and container delays
Apache License 2.0
27 stars 13 forks source link

CVE-2022-41723: high severity vulnerability in golang.org/x/net library #8

Open pimperator opened 1 year ago

pimperator commented 1 year ago

Hi Guys, today I've scanned goss via trivy and it seems like a dependency needs to be updated in the latest version. This is the output I recieve: Total: 2 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌──────────────────┬─────────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│     Library      │    Vulnerability    │ Severity │ Installed Version │ Fixed Version │                            Title                            │
├──────────────────┼─────────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2022-41723      │ HIGH     │ v0.5.0            │ 0.7.0         │ golang.org/x/net/http2: avoid quadratic complexity in HPACK │
│                  │                     │          │                   │               │ decoding                                                    │
│                  │                     │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-41                  │
│                  ├─────────────────────┼──────────┤                   │               ├─────────────────────────────────────────────────────────────┤
│                  │ GHSA-vvpx-j8f3-3w6h │ UNKNOWN  │                   │               │ Uncontrolled Resource Consumption                           │
│                  │                     │          │                   │               │ https://github.com/advisories/GHSA-vvpx-j8f3-3w6h           │
└──────────────────┴─────────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

This is how to reproduce the error: trivy image --exit-code 0 --cache-dir .trivycache/ --no-progress "$FULL_IMAGE_NAME" while FULL_IMAGE_NAME is the container name