[DepShield] (CVSS 5.9) Vulnerability due to usage of golang.org/x:crypto:0.0.0-20181029021203-45a5f77698d3

[sonatype-depshield[bot]]

Vulnerabilities

DepShield reports that this application's usage of golang.org/x:crypto:0.0.0-20181029021203-45a5f77698d3 results in the following vulnerability(s):

• (CVSS 5.9) [CVE-2019-11840] Use of Insufficiently Random Values

---

Occurrences

golang.org/x:crypto:0.0.0-20181029021203-45a5f77698d3 is a transitive dependency introduced by the following direct dependency(s):

• github.com/spf13:viper:1.7.1         └─ github.com/bketelsen:crypt:0.0.3-0.20200106085610-5cbc8cc4026c               └─ github.com/hashicorp/consul:api:1.1.0                     └─ github.com/hashicorp:serf:0.8.2                           └─ github.com/hashicorp:mdns:1.0.0                                 └─ golang.org/x:crypto:0.0.0-20181029021203-45a5f77698d3                           └─ github.com/hashicorp:memberlist:0.1.3                                 └─ golang.org/x:crypto:0.0.0-20181029021203-45a5f77698d3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DarthHater]

@bhamail this is a false positive correct (since we replace this)?

[bhamail]

@DarthHater Hm. We used to replace it, but since upgrading to the latest dependency versions, we no longer need to replace it, so we no longer replace it. The current code uses a newer version than the one reported by depshield above. e.g.

$ go list -m all | grep crypto
golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586

Is DepShield using old info? Or am I missing something?

[DarthHater]

It appears DepShield uses go mod graph to get a list, and that seems to be the issue. This is a false positive, best I can tell.

[bhamail]

Closing as false positive. The app actually uses a different version of crypto than reported by go mod graph:

$ go list -m all | grep crypto
golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586