Potential vulnerabilities because of old version of go

tianon / gosu

Simple Go-based setuid+setgid+setgroups+exec

Apache License 2.0

4.68k stars 312 forks source link

Potential vulnerabilities because of old version of go #111

Closed slakwa closed 2 years ago

slakwa commented 2 years ago

Hi,

Our twistlock scan is showing that because of the older version of go that you are using you can potentially be affected by 12 vulnerabilites. Here is the list:

Critical: CVE-2022-23806 CVE-2021-38297 High: CVE-2021-41771 CVE-2021-41772 CVE-2021-29923 CVE-2021-44716 CVE-2022-28327 CVE-2022-23773 CVE-2022-24921 CVE-2022-24675 CVE-2021-39293 CVE-2022-23772

Can you please check if they are legit or only false-positive? Thanks!

yosifkit commented 2 years ago

See https://github.com/tianon/gosu/issues/104; all of the CVE's that you listed are there.