search

containernetworking / plugins

Some reference and example networking plugins, maintained by the CNI team.
Apache License 2.0
2.24k stars 789 forks source link

Denial Of Service vulnerability discovered in Golang (CVE-2022-27664) in some plugins #846

Closed gaborho closed 1 year ago

gaborho commented 1 year ago

Our cloud security platform discovered "Denial Of Service vulnerability discovered in Golang. (https://github.com/advisories/GHSA-69cg-p879-7622)" in our Bottlerocket OS based EKS worker nodes, which is using amazon-vpc-cni-k8s plugin. Further analysis showed that some plugins are pulled in from this upstream project, and I was asked to report here the issue as well. Please take a look on this issue and on this comment, and do the necessary action (I assume to build with 1.19 Go SDK) the plugins in order to fix the vulnerability.

squeed commented 1 year ago

While we do build with go1.19, and we will cut a release soon, the cni plugins make no HTTP/2 network requests, and thus are not affected by this vulnerability.