search

sonatype-nexus-community / ahab

ahab is a tool to check for vulnerabilities in your apt, apk, or yum powered operating systems, powered by Sonatype OSS Index.
Apache License 2.0
68 stars 18 forks source link

fix vulnerability: CVE-2021-3121 in github.com/gogo/protobuf v1.2.1 #69

Closed bhamail closed 3 years ago

bhamail commented 3 years ago

cc @bhamail / @DarthHater

bhamail commented 3 years ago

If it works it works! What do we even use protobuf for (I doubt we do, probs brought in by something else?)

Yeah, brought in by something else, e.g. viper:

$ go list -m all | grep 'github.com/gogo/protobuf'
github.com/gogo/protobuf v1.2.1 => github.com/gogo/protobuf v1.3.2
(base) MBP-DRollo5:ahab bhamail$ go mod graph | grep 'github.com/gogo/protobuf'
github.com/spf13/viper@v1.4.0 github.com/gogo/protobuf@v1.2.1
github.com/gogo/protobuf@v1.1.1 github.com/kisielk/errcheck@v1.5.0
github.com/gogo/protobuf@v1.1.1 github.com/kisielk/gotool@v1.0.0
github.com/gogo/protobuf@v1.1.1 golang.org/x/tools@v0.0.0-20210106214847-113979e3529a
github.com/prometheus/tsdb@v0.7.1 github.com/gogo/protobuf@v1.1.1
github.com/gogo/protobuf@v1.2.1 golang.org/x/tools@v0.0.0-20210106214847-113979e3529a
github.com/gogo/protobuf@v1.2.1 github.com/kisielk/gotool@v1.0.0
github.com/gogo/protobuf@v1.2.1 github.com/kisielk/errcheck@v1.5.0
github.com/prometheus/common@v0.4.0 github.com/gogo/protobuf@v1.1.1
github.com/spf13/viper@v1.7.1 github.com/gogo/protobuf@v1.2.1