search

sirupsen / logrus

Structured, pluggable logging for Go.
MIT License
24.3k stars 2.26k forks source link

Logrus potential DOS - Please open a CVE for issue #1370 to encourage users to patch #1400

Closed vsabella closed 8 months ago

vsabella commented 10 months ago

Team,

Issue #1370 was identified by private vulnerability databases for example, Twistlock/Prismacloud (PRISMA-2023-0056) However to get most open-source projects to update to the fixed version (v1.9.3) they require an actual CVE. Would you consider opening an actual CVE against your <= 1.9.2 releases?

cb-axon commented 10 months ago

Just so that you are aware, you can easily request/get CVEs through GitHub by following these instructions: https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/creating-a-repository-security-advisory

https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/publishing-a-repository-security-advisory#requesting-a-cve-identification-number-optional

github-actions[bot] commented 9 months ago

This issue is stale because it has been open for 30 days with no activity.

github-actions[bot] commented 8 months ago

This issue was closed because it has been inactive for 14 days since being marked as stale.