search

billmcchesney1 / terraform-provider-restapi

A terraform provider to manage objects in a RESTful API
Other
0 stars 0 forks source link

CVE-2020-16845 (High) detected in github.com/ulikunitz/xz-v0.5.5 #26

Open mend-for-github-com[bot] opened 2 years ago

mend-for-github-com[bot] commented 2 years ago

CVE-2020-16845 - High Severity Vulnerability

Vulnerable Library - github.com/ulikunitz/xz-v0.5.5

Pure golang package for reading and writing xz-compressed files

Library home page: https://proxy.golang.org/github.com/ulikunitz/xz/@v/v0.5.5.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Dependency Hierarchy: - github.com/hashiCorp/terraform-v0.12.0-beta2 (Root Library) - github.com/hashicorp/go-getter-v1.1.0 - :x: **github.com/ulikunitz/xz-v0.5.5** (Vulnerable Library)

Found in HEAD commit: f7fe51cfc9cb28df7c91cd678cb98694031e1c0a

Found in base branch: master

Vulnerability Details

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Publish Date: 2020-08-06

URL: CVE-2020-16845

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-q6gq-997w-f55g

Release Date: 2020-08-06

Fix Resolution: go1.13.15,go1.14.7,github.com/ulikunitz/xz - v0.5.8