search

krakend / krakend-ce

KrakenD Community Edition: High-performance, stateless, declarative, API Gateway written in Go.
https://www.krakend.io
Apache License 2.0
1.92k stars 452 forks source link

KrakenD v2.7 new vulnerability CVE-2024-34156 #922

Closed MoeBensu closed 1 week ago

MoeBensu commented 1 week ago

Environment info:

Describe the bug CVE-2024-34156 has been published against the stdlib lib in go binaries and is found by trivy in docker image v2.7 which uses go1.22.5

Screenshot 2024-09-10 at 09 37 56

It is recommended to fix with the patch go1.22.7 or the very recent minor update go1.23.1. Which one would you prefer to go with?

It is also the question, wether the package encoding/gob is used in krakend-ce or not.

Commands used trivy image -v devopsfaith/krakend:2.7

Expected behavior No high/critical vulnerability report.

kpacha commented 1 week ago

The pkg gopkg.in/square/go-jose.v2 has been replaced and the stdlib updated to 1.22.7. The PR (https://github.com/krakend/krakend-ce/pull/920) was merged yesterday and today we released v2.7.1 (https://github.com/krakend/krakend-ce/releases/tag/v2.7.1)