Various Vulnerabilities High and Medium scores.

[Aurelian-Shuttleworth]

Describe the bug

Multiple High and medium Vulnerabilities are included due to out of date packages.

High:

• CVE-2023-44487
• CVE-2022-41723
• CVE-2022-27664
• CVE-2022-41723
• CVE-2023-44487

Medium:

• CVE-2022-41717
• CVE-2022-29526

How to fix

• go get github.com/hashicorp/[email protected]
• go get golang.org/x/[email protected]
• go get google.golang.org/[email protected]
• go get golang.org/x/[email protected]

[Aurelian-Shuttleworth]

I have a working fork that I can convert to a merge request.

[khos2ow]

@Aurelian-Shuttleworth thank you for reporting this, and please do create a PR, if you already have a working fix.

[KostLinux]

Trivy scan also sent me some CVE's that are not in the list

Major - CVE-2022-27664 - golang.org/x/net - v0.0.0-20210405180319-a5a99cb37ef4 - golang: net/http: handle server errors after sending GOAWAY

Major - CVE-2022-41723 - golang.org/x/net - v0.0.0-20210405180319-a5a99cb37ef4 - net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding

Major - CVE-2023-39325 - golang.org/x/net - v0.0.0-20210405180319-a5a99cb37ef4 - golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)

Major - CVE-2021-38561 - golang.org/x/text - v0.3.5 - golang: out-of-bounds read in golang.org/x/text/language leads to DoS

Major - CVE-2022-32149 - golang.org/x/text - v0.3.5 - ParseAcceptLanguage takes a long time to parse complex tags

Major - GHSA-m425-mq94-257g - google.golang.org/grpc - v1.38.0 - gRPC-Go HTTP/2 Rapid Reset vulnerability

Major - CVE-2022-28948 - gopkg.in/yaml.v3 - v3.0.0-20210107192922-496545a6307b - crash when attempting to deserialize invalid input

@Aurelian-Shuttleworth @khos2ow

[Aurelian-Shuttleworth]

@khos2ow Apologies for the delay. I will prepare a MR now.

[Aurelian-Shuttleworth]

@khos2ow please review the PR-727

@KostLinux can you test the updated image in PR-727 against trivy I don't have time currently.

[Aurelian-Shuttleworth]

@khos2ow Now that the latest changes have been merged, will it be possible to publish a v0.16.1 release?

[khos2ow]

Yes, I'm actually going through the PRs now to see which I can quickly merge and will cut a v0.17.0 release afterwards.

[khos2ow]

These should now be fixed in v0.17.0