kserve / modelmesh-serving

Controller for ModelMesh
Apache License 2.0
189 stars 106 forks source link

chore: Address github.com/pkg/sftp Denial of Service (DoS) #482

Closed davidesalerno closed 5 months ago

davidesalerno commented 5 months ago

Motivation

This change will fix the CVE reported by https://app.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMPKGSFTP-569475

Modifications

Only go.mod and go.sum will be changed using a github.com/pkg/sftp module version without the security issue.

Result

Avoid issues like Denial of Service (DoS) caused by the old version of the github.com/pkg/sftp module

oss-prow-bot[bot] commented 5 months ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: davidesalerno Once this PR has been reviewed and has the lgtm label, please assign njhill for approval by writing /assign @njhill in a comment. For more information see:The Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/kserve/modelmesh-serving/blob/main/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
oss-prow-bot[bot] commented 5 months ago

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: davidesalerno Once this PR has been reviewed and has the lgtm label, please assign njhill for approval by writing /assign @njhill in a comment. For more information see:The Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files: - **[OWNERS](https://github.com/kserve/modelmesh-serving/blob/main/OWNERS)** Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment
davidesalerno commented 5 months ago

@ckadner @Jooho Could you help me reviewing this change?

davidesalerno commented 5 months ago

Closing PR since it's a duplicate of #480