Fetch CVE-2022-27664 - Githubissues

trsreagan3 commented 1 year ago

this scan was run against version 0.4.2 as that is what is installed by gruntwork-installer. If this has been patched in one of the recent releases this can be closed
CVE-2022-27664
Installed version: 1.16.2 Patched version: 1.18.6 Paths: /usr/local/bin/fetch
Description In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, a closing HTTP/2 server connection could hang forever waiting for a clean shutdown that was preempted by a subsequent fatal error. This failure mode could be exploited to cause a denial of service.
References https://nvd.nist.gov/vuln/detail/CVE-2022-27664

gitsstewart commented 1 year ago

Thanks for bringing this to our attention @trsreagan3 . We will have a look and take steps to prioritize work accordingly.

josh-padnick commented 1 year ago

Should we close this issue given that #116 is merged?

gruntwork-io / fetch