search

monetr / web-ui

Web interface for the budgeting application.
Other
1 stars 2 forks source link

CVE-2020-28852 (High) detected in github.com/golang/text-v0.3.3 - autoclosed #626

Closed mend-bolt-for-github[bot] closed 3 years ago

mend-bolt-for-github[bot] commented 3 years ago

CVE-2020-28852 - High Severity Vulnerability

Vulnerable Library - github.com/golang/text-v0.3.3

[mirror] Go text processing support

Dependency Hierarchy: - github.com/go-git/go-git-v5.4.0 (Root Library) - :x: **github.com/golang/text-v0.3.3** (Vulnerable Library)

Found in HEAD commit: e5e69ae16cd24e942b27565f93a7d5c548b72bab

Found in base branch: main

Vulnerability Details

In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

Publish Date: 2021-01-02

URL: CVE-2020-28852

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: https://github.com/golang/text/commit/4482a914f52311356f6f4b7a695d4075ca22c0c6

Release Date: 2020-11-18

Fix Resolution: Replace or update the following files: parse.go, parse_test.go

Step up your Open Source Security Game with WhiteSource here

mend-bolt-for-github[bot] commented 3 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.