SCA Go module Component- etcd

PratyakshaSinha commented 3 years ago

Component name : etcd
Component Path :

file7593245448_1618770505800_html/go.sum/github.com/hashicorp/consul file7593253354_1618771275007_html/go-test/go.sum/github.com/hashicorp/consul

CVE ID : CVE-2018-1098

https://nvd.nist.gov/vuln/detail/CVE-2018-1098

Vulnerability description :

Cross-site Request Forgery (CSRF): github.com/coreos/etcd is vulnerable to cross-site request forgery (CSRF) attacks. The vulnerability exists as there are no host whitelists in place to prevent unauthorized websites from sending unauthorized POST requests to the etcd server.

Reference Link : https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsSCA:11695:1065071:11719443:11685260:11700923:::::3086468:

Aha! Link: https://chef.aha.io/epics/SH-E-569

kalroy commented 3 years ago

We need to upgrade to version v3.4.16

mchengat88 commented 3 years ago

Need to update both github.com/bufbuild/buf@v0.20.5 and github.com/spf13/cobra@v1.0.1-0.20200713175500-884edc58ad08.

bufbuild/buf upgrade requires go1.16. We have to keep this on hold until we upgrade the go version to 1.16.

chef / automate

SCA Go module Component- etcd #5139