Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: suggestion regarding GO-2023-2328 vulnerability solved in release v2.11.0 #2427

Closed
Bart-vanDongen opened this issue Dec 29, 2023 · 3 comments
Closed

x/vulndb: suggestion regarding GO-2023-2328 vulnerability solved in release v2.11.0 #2427

Bart-vanDongen opened this issue Dec 29, 2023 · 3 comments
Assignees
@tatianab
Labels
Suggested Edit

Comments

@Bart-vanDongen
Copy link

Report ID

GO-2023-2328

Suggestion/Comment

It looks like this vulnerability is solved in release v2.11.0.

"Security: Don't put the same bytes.Buffer into sync.Pool twice by @lattwood in go-resty/resty#745, go-resty/resty#764, go-resty/resty#756 "
@billinghamj billinghamj mentioned this issue Jan 3, 2024
Closed
@ncw
Copy link

ncw commented Jan 4, 2024

Can whatever needs to be done to mark this as solved be done, pretty please? This vulnerability has been hanging around for ages and I'm fed up with seeing it in my govuln reports!

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/554155 mentions this issue: data/reports: update GO-2023-2328.yaml

@tatianab tatianab self-assigned this Jan 4, 2024
gopherbot pushed a commit that referenced this issue Jan 4, 2024
@tatianab
data/reports: update GO-2023-2328.yaml
aca7204 
Add fixed version and fix commit.

Aliases: CVE-2023-45286, GHSA-xwh9-gc39-5298

Updates #2328
Updates #2427

Change-Id: Ia8373db660975a01f455d2b60d5e1d9f73a2c30b
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/554155
Reviewed-by: Tim King <taking@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
@tatianab
Copy link
Contributor

tatianab commented Jan 4, 2024

Thanks - the report has now been updated (https://pkg.go.dev/vuln/GO-2023-2328).

@tatianab tatianab closed this as completed Jan 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tatianab tatianab

Labels
Suggested Edit
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@ncw @tatianab @gopherbot @Bart-vanDongen