search

tianon / gosu

Simple Go-based setuid+setgid+setgroups+exec
Apache License 2.0
4.68k stars 312 forks source link

Vulnerabilities reported against golang 1.16.7 #98

Closed jbennettjr closed 2 years ago

jbennettjr commented 2 years ago

Our security scanning is detecting the following vulnerabilites related to golang version 1.16.7. https://nvd.nist.gov/vuln/detail/CVE-2021-38297 https://nvd.nist.gov/vuln/detail/CVE-2021-41771 https://nvd.nist.gov/vuln/detail/CVE-2021-44716

Would you be able to comment on if gosu has exposure to these vulnerabilities?

tianon commented 2 years ago

https://nvd.nist.gov/vuln/detail/CVE-2021-38297

From that page: "... when GOARCH=wasm GOOS=js" :see_no_evil:

(That does not apply to gosu. I'm not sure it even could work via WASM?)

https://nvd.nist.gov/vuln/detail/CVE-2021-41771

From that page: "ImportedSymbols in debug/macho (for Open or OpenFat) ..."

I've frankly never heard of debug/macho before now, must less used it (intentionally or otherwise). :sweat_smile:

I'm not sure whether it helps in this case, but a related datapoint is that the gosu binaries I publish are all compiled with -ldflags '-d -s -w', so shouldn't even have debug symbols in them.

https://nvd.nist.gov/vuln/detail/CVE-2021-44716

From that page: "net/http in Go ..."

The gosu binaries don't ever invoke net/http (to my knowledge). At a high level, they parse /etc/passwd and /etc/group, and invoke a couple system calls.

I think it's pretty safe to say none of these apply to gosu.