This repository has been archived by the owner on Mar 20, 2024. It is now read-only.
github.com/golang/oauth2-bf48bf16ab8d622ce64ec6ce98d2c98f916b6303: 5 vulnerabilities (highest severity is: 7.5) #78
Labels
Mend: dependency security vulnerability
Security vulnerability detected by Mend
Comments
mend-for-github-com
bot
added
the
Mend: dependency security vulnerability
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
|
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory. |
mend-for-github-com
bot
changed the title
mend-for-github-com
bot
changed the title
|
ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Path to dependency file: /go.mod
Path to vulnerable library: /go.mod
Found in HEAD commit: 821b439313de9340f2f41fa36d5cee25e1ab2361
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - github.com/golang/net-v0.0.0-20190603091049-60506f45cf65
[mirror] Go supplementary network libraries
Library home page: https://proxy.golang.org/github.com/golang/net/@v/v0.0.0-20190603091049-60506f45cf65.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go.mod
Dependency Hierarchy:
Found in HEAD commit: 821b439313de9340f2f41fa36d5cee25e1ab2361
Found in base branch: master
Vulnerability Details
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
Publish Date: 2023-01-13
URL: CVE-2022-41721
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2023-01-13
Fix Resolution: v0.2.0
Vulnerable Library - github.com/golang/net-v0.0.0-20190603091049-60506f45cf65
[mirror] Go supplementary network libraries
Library home page: https://proxy.golang.org/github.com/golang/net/@v/v0.0.0-20190603091049-60506f45cf65.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go.mod
Dependency Hierarchy:
Found in HEAD commit: 821b439313de9340f2f41fa36d5cee25e1ab2361
Found in base branch: master
Vulnerability Details
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
Publish Date: 2022-09-06
URL: CVE-2022-27664
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://pkg.go.dev/vuln/GO-2022-0969
Release Date: 2022-09-06
Fix Resolution: golang.org/x/net - 0.0.0-20220906165146-f3363e06e74c, go1.18.6, go1.19.1
Vulnerable Library - github.com/golang/net-v0.0.0-20190603091049-60506f45cf65
[mirror] Go supplementary network libraries
Library home page: https://proxy.golang.org/github.com/golang/net/@v/v0.0.0-20190603091049-60506f45cf65.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go.mod
Dependency Hierarchy:
Found in HEAD commit: 821b439313de9340f2f41fa36d5cee25e1ab2361
Found in base branch: master
Vulnerability Details
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
Publish Date: 2022-01-01
URL: CVE-2021-44716
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-vc3p-29h2-gpcp
Release Date: 2022-01-01
Fix Resolution: github.com/golang/net - 491a49abca63de5e07ef554052d180a1b5fe2d70
Vulnerable Library - github.com/golang/net-v0.0.0-20190603091049-60506f45cf65
[mirror] Go supplementary network libraries
Library home page: https://proxy.golang.org/github.com/golang/net/@v/v0.0.0-20190603091049-60506f45cf65.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go.mod
Dependency Hierarchy:
Found in HEAD commit: 821b439313de9340f2f41fa36d5cee25e1ab2361
Found in base branch: master
Vulnerability Details
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
Publish Date: 2021-05-26
URL: CVE-2021-33194
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33194
Release Date: 2021-05-26
Fix Resolution: golang.org/x/net - v0.0.0-20210520170846-37e1c6afe023
Vulnerable Library - github.com/golang/net-v0.0.0-20190603091049-60506f45cf65
[mirror] Go supplementary network libraries
Library home page: https://proxy.golang.org/github.com/golang/net/@v/v0.0.0-20190603091049-60506f45cf65.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go.mod
Dependency Hierarchy:
Found in HEAD commit: 821b439313de9340f2f41fa36d5cee25e1ab2361
Found in base branch: master
Vulnerability Details
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
Publish Date: 2021-05-27
URL: CVE-2021-31525
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1958341
Release Date: 2021-05-27
Fix Resolution: golang - v1.15.12,v1.16.4,v1.17.0
The text was updated successfully, but these errors were encountered: