search

gcla / termshark

A terminal UI for tshark, inspired by Wireshark
MIT License
9.06k stars 397 forks source link

Vulnerability of dependency "golang.org/x/net" #157

Open Silence-worker-02 opened 1 year ago

Silence-worker-02 commented 1 year ago

Hello, we are a team researching the dependency management mechanism of Golang. During our analysis, we came across your project and noticed that it contains a vulnerability (CVE-2022-41723). In your project, the golang.org/x/net package is being used at version golang.org/x/net v0.0.0-20220520000938-2e3eb7b945c2, but the patched version is v0.7.0. To fix the vulnerability, we recommend modifying the go.mod file to update the version to v0.7.0. Thank you for your attention to this matter.

Silence-worker-02 commented 1 year ago

We also came across your project and noticed that it contains a vulnerability (CVE-2022-32149). In your project, the golang.org/x/text package is being used at version golang.org/x/text v0.3.7, but the patched version is v0.3.8. To fix the vulnerability, we recommend modifying the go.mod file to update the version to v0.3.8 or higher. Thank you for your attention to this matter.

bucketcat commented 10 months ago

Any reason why Dependabot (properly configured for Go) isn't picking up on this?

Edit: Because x/Net is being inherited through the x wildcard. Adding x/Net to go.mod caused it to instantly pick up on it.

This is maybe an issue with Dependabot not going through all sub packages and lazy developers importing entire packages rather than being narrow.