gopkg.in/yaml.v2 Denial of Service (DoS) [nerdctl is NOT affected by this CVE] #1135
Conversation
fahedouch
force-pushed
the
upgrade-yaml-gopkg
branch
2 times, most recently
from
66f7af5 to
89b5b8f
Compare
| @@ -170,6 +170,7 @@ require ( | |||
| google.golang.org/grpc v1.47.0 // indirect | |||
| google.golang.org/protobuf v1.28.0 // indirect | |||
| gopkg.in/square/go-jose.v2 v2.5.1 // indirect | |||
| gopkg.in/yaml.v2 v2.4.0 // indirect | |||
There was a problem hiding this comment.
compose-go needs to be fixed too
There was a problem hiding this comment.
@AkihiroSuda compose-spec/compose-go#153 is still Draft, can we merge this before compose-go ?
|
I don't think the CVE affects us. We don't launch a server that accepts YAML from an untrusted source. |
AkihiroSuda
changed the title
Agree but it is always good to upgrade to non-vulnerable version to avoid scanner noise. It looks like we should point to this fork https://github.com/compose-spec/compose-go/pull/153/files#diff-33ef32bf6c23acb95f5902d7097b7a1d5128ca061167ec0716715b0b9eeaa5f6R24 as compose is doing. |
fahedouch
force-pushed
the
upgrade-yaml-gopkg
branch
from
2b01bbf to
89b5b8f
Compare
|
Needs rebase |
fahedouch
force-pushed
the
upgrade-yaml-gopkg
branch
3 times, most recently
from
62ef1b6 to
bd6a7af
Compare
go.mod
Outdated
| golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f | ||
| golang.org/x/crypto v0.0.0-20220513210258-46612604a0f9 | ||
| golang.org/x/net v0.0.0-20220516133312-45b265872317 | ||
| golang.org/x/sync v0.0.0-20220513210516-0976fa681c29 |
There was a problem hiding this comment.
Sorry it was a rebase issue!
fahedouch
force-pushed
the
upgrade-yaml-gopkg
branch
from
3805ee2 to
af9d72b
Compare
Signed-off-by: Fahed DORGAA <fahed.dorgaa@gmail.com>
fahedouch
force-pushed
the
upgrade-yaml-gopkg
branch
from
af9d72b to
81095fb
Compare
gopkg.in/yaml.v2 has vulnerability https://nvd.nist.gov/vuln/detail/CVE-2019-11254.
need to upgrade gopkg.in/yaml.v2 to version 2.2.8 or higher.
Signed-off-by: Fahed DORGAA fahed.dorgaa@gmail.com