ory / hydra

The most scalable and customizable OpenID Certified™ OpenID Connect and OAuth Provider on the market. Become an OpenID Connect and OAuth2 Provider over night. Broad support for related RFCs. Written in Go, cloud native, headless, API-first. Available as a service on Ory Network and for self-hosters.
https://www.ory.sh/?utm_source=github&utm_medium=banner&utm_campaign=hydra
Apache License 2.0
15.67k stars 1.5k forks source link

Go related CVEs raised during Twistlock scanning resolution timeline by upgrading go version #3440

Closed guyibm closed 1 year ago

guyibm commented 1 year ago

Preflight checklist

Describe the bug

Will the Go version of the project be updated to latest 1.19.x to address CVEs such as https://nvd.nist.gov/vuln/detail/CVE-2022-41715. I see Go on version 1.19.1 in the latest Hydra version v2.0.3. CVEs like this one are being raised during Twistlock scanning for the Go version. Would this be in the next release (v2.0.4) and would you happen to know the timeline for that release?

Reproducing the bug

Run Twistlock scan on Hydra image.

Relevant log output

No response

Relevant configuration

No response

Version

v2.0.3

On which operating system are you observing this issue?

None

In which environment are you deploying?

Kubernetes

Additional Context

No response

aeneasr commented 1 year ago

Thank you for the report. The listed CVEs do not affect Ory Hydra's code base. In the future, please follow our security policy: https://github.com/ory/hydra/security/policy