search

aws / rolesanywhere-credential-helper

Apache License 2.0
128 stars 38 forks source link

This fails docker scout security scan #59

Open hookenz opened 1 year ago

hookenz commented 1 year ago

Due to using the old aws golang library instead of the v2 library this binary is vulnerable to the following CVEs

CVE-2020-8911⁠ CVE-2020-8912⁠

To fix it we need to upgrade to using github.com/aws/aws-sdk-go-v2

Affected version: all versions <= 1.1.1 (latest release).

hookenz commented 10 months ago

As we use this library our docker image is flagged by docker scout.

I had a go at an upgrade by it's not trivial.