Giter Club home page Giter Club logo

petasos's Introduction

petasos

(pronounced "pet-uh-sos")

Build Status codecov.io Go Report Card Quality Gate Status Apache V2 License GitHub Release

Summary

Petasos is the HTTP redirector component of XMiDT. Petasos will redirect http requests to a talaria depending on the the device id and talaria service discovery configuration.

Table of Contents

Code of Conduct

This project and everyone participating in it are governed by the XMiDT Code Of Conduct. By participating, you agree to this Code.

Details

Petasos has one function: to redirect incoming requests to the correct talaria. The two types of requests are from a device looking to connect to talaria and from scytale looking to forward a request to a device. In either case, petasos returns an http 307 redirect to the talaria. Petasos determines the correct talaria via service discovery configuration. Currently, petasos can be configured either to dynamically coordinate talarias via Consul (consul option) or be statically configured (fixed option). Refer to cluster configuration for more information.

Any URI paths (e.g. /api/v2/device, /api/v2/device/send) will be redirected to the talaria; petasos doesn't parse or validate the path in the request. In order for petasos to complete the request, the X-Webpa-Device-Name header must be included.

For example, a docker container running with a fixed configuration will produce the following:

$ curl -i  -H "X-Webpa-Device-Name:mac:112233445566" localhost:6400/
HTTP/1.1 307 Temporary Redirect
Content-Type: text/html; charset=utf-8
Location: http://talaria:6200
X-Petasos-Build: 0.1.4
X-Petasos-Flavor: mint
X-Petasos-Region: east
X-Petasos-Server: petasos
X-Petasos-Start-Time: 03 Sep 19 15:39 UTC
Date: Tue, 03 Sep 2019 15:40:04 GMT
Content-Length: 55

<a href="http://talaria:6200">Temporary Redirect</a>.

Build

Source

In order to build from the source, you need a working Go environment with version 1.11 or greater. Find more information on the Go website.

You can directly use go get to put the petasos binary into your GOPATH:

GO111MODULE=on go get github.com/xmidt-org/petasos

You can also clone the repository yourself and build using make:

mkdir -p $GOPATH/src/github.com/xmidt-org
cd $GOPATH/src/github.com/xmidt-org
git clone [email protected]:xmidt-org/petasos.git
cd petasos
make build

Makefile

The Makefile has the following options you may find helpful:

  • make build: builds the petasos binary
  • make docker: builds a docker image for petasos, making sure to get all dependencies
  • make local-docker: builds a docker image for petasos with the assumption that the dependencies can be found already
  • make test: runs unit tests with coverage for petasos
  • make clean: deletes previously-built binaries and object files

RPM

First have a local clone of the source and go into the root directory of the repository. Then use rpkg to build the rpm:

rpkg srpm --spec <repo location>/<spec file location in repo>
rpkg -C <repo location>/.config/rpkg.conf sources --outdir <repo location>'

Docker

The docker image can be built either with the Makefile or by running a docker command. Either option requires first getting the source code.

See Makefile on specifics of how to build the image that way.

For running a command, either you can run docker build after getting all dependencies, or make the command fetch the dependencies. If you don't want to get the dependencies, run the following command:

docker build -t petasos:local -f deploy/Dockerfile .

If you want to get the dependencies then build, run the following commands:

GO111MODULE=on go mod vendor
docker build -t petasos:local -f deploy/Dockerfile.local .

For either command, if you want the tag to be a version instead of local, then replace local in the docker build command.

Kubernetes

A helm chart can be used to deploy petasos to kubernetes

helm install xmidt-petasos deploy/helm/petasos

Deploy

For deploying a XMiDT cluster refer to getting started.

For running locally, ensure you have the binary built. If it's in your GOPATH, run:

petasos

If the binary is in your current folder, run:

./petasos

Contributing

Refer to CONTRIBUTING.md.

petasos's People

Contributors

denopink avatar dependabot[bot] avatar equanox avatar jcscottiii avatar joe94 avatar johnabass avatar kcajmagic avatar kraj avatar kristinapathak avatar maurafortino avatar njharter avatar renaz6 avatar sachin4403 avatar schmidtw avatar sholaday avatar utsavbatra5 avatar

Stargazers

 avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

petasos's Issues

CVE-2020-14040 (High) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2020-14040 - High Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Publish Date: 2020-06-17

URL: CVE-2020-14040

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2020-0015

Release Date: 2020-06-17

Fix Resolution: v0.3.3


Step up your Open Source Security Game with Mend here

Rename master branch to main

Also have to change references to the branch in .travis.yml, README, and CONTRIBUTING. Double check any other markdown files as well - sometimes links have the branch name in them.

Bug: Patch Failing Docker Image

The Dockerfile needs to be updated to include this patch:
xmidt-org/tr1d1um@df49bb5

Steps:

  • fix breaking candlelight changes
  • fix breaking go.opentelemetry.io/otel/trace changes
  • fix breaking go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp changes
  • fix linter errors
  • replace deprecated library usage

(unify) Use SPDX for copyright and reuse.

Copyright header update

Replace the full apache header at the top of each file with this:

// SPDX-FileCopyrightText: {{DATE}} Comcast Cable Communications Management, LLC
// SPDX-License-Identifier: Apache-2.0

Replacing {{DATE}} with the copyright date in the file.

For all go files that are not generated and are missing this header add it.

Reuse preparation

Install: reuse

Create a directory named .reuse.

Add the file .reuse/deb5 with contents based on this:

Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: {{REPO}}
Upstream-Contact: {{MAINTAINER}}
Source: https://github.com/xmidt-org/{{REPO}}

Files: .golangci.yml
Copyright: SPDX-FileCopyrightText: 2023 Comcast Cable Communications Management, LLC
License: Apache-2.0

Files: go.mod
Copyright: SPDX-FileCopyrightText: 2023 Comcast Cable Communications Management, LLC
License: Apache-2.0

Files: go.sum
Copyright: SPDX-FileCopyrightText: 2023 Comcast Cable Communications Management, LLC
License: Apache-2.0

Files: .gitignore
Copyright: SPDX-FileCopyrightText: 2023 Comcast Cable Communications Management, LLC
License: Apache-2.0

Files: MAINTAINERS.md
Copyright: SPDX-FileCopyrightText: 2023 Comcast Cable Communications Management, LLC
License: Apache-2.0

Files: README.md
Copyright: SPDX-FileCopyrightText: 2023 Comcast Cable Communications Management, LLC
License: Apache-2.0

Files: .whitesource
Copyright: SPDX-FileCopyrightText: 2023 Comcast Cable Communications Management, LLC
License: Apache-2.0

You may need to add/change files that cannot have copyright headers later.

Installing licenses

Run:

reuse download Apache-2.0

Checking the repo is compliant

Run:

reuse lint

you should see something similar to this:

# SUMMARY

* Bad licenses:
* Deprecated licenses:
* Licenses without file extension:
* Missing licenses:
* Unused licenses:
* Used licenses: Apache-2.0
* Read errors: 0
* Files with copyright information: 14 / 14
* Files with license information: 14 / 14

Congratulations! Your project is compliant with version 3.0 of the REUSE Specification :-)

If not, fix the issues.

Enable copyright checking in the action

In .github.workflows/ci.yml remove the line copyright-skip: true.

CVE-2020-25201 (High) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2020-25201 - High Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in 1.7.9 and 1.8.5.

Publish Date: 2020-11-04

URL: CVE-2020-25201

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#185-october-23-2020

Release Date: 2020-11-04

Fix Resolution: 1.8.5


Step up your Open Source Security Game with Mend here

CVE-2021-38561 (High) detected in github.com/golang/text-v0.3.6 - autoclosed

CVE-2021-38561 - High Severity Vulnerability

Vulnerable Library - github.com/golang/text-v0.3.6

[mirror] Go text processing support

Dependency Hierarchy:

  • github.com/spf13/viper-v1.7.1 (Root Library)
    • github.com/spf13/afero-v1.2.2
      • github.com/golang/text-v0.3.6 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

Due to improper index calculation, an incorrectly formatted language tag can cause Parse
to panic, due to an out of bounds read. If Parse is used to process untrusted user inputs,
this may be used as a vector for a denial of service attack.

Publish Date: 2021-08-12

URL: CVE-2021-38561

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2021-0113

Release Date: 2021-08-12

Fix Resolution: v0.3.7


Step up your Open Source Security Game with Mend here

Error messages removed from payload and added as header

As part of streamlining the error reporting for api requests:

  1. payload returned for a non-success responses should be empty
  2. a header (x-xmidt-message-error ) should be return with the appropriate error message

note: petasos can return 500 + message when no talarias are available and 400 (see #23)

CVE-2020-13250 (High) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2020-13250 - High Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4.

Publish Date: 2020-06-11

URL: CVE-2020-13250

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13250

Release Date: 2020-06-11

Fix Resolution: 1.6.6,1.7.4


Step up your Open Source Security Game with Mend here

CVE-2020-26160 (High) detected in github.com/dgrijalva/jwt-go-v3.2.0 - autoclosed

CVE-2020-26160 - High Severity Vulnerability

Vulnerable Library - github.com/dgrijalva/jwt-go-v3.2.0

Golang implementation of JSON Web Tokens (JWT)

Dependency Hierarchy:

  • github.com/xmidt-org/webpa-common-v1.11.9 (Root Library)
    • github.com/xmidt-org/argus-v0.5.0
      • github.com/dgrijalva/jwt-go-v3.2.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

Publish Date: 2020-09-30

URL: CVE-2020-26160

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-26160

Release Date: 2020-09-30

Fix Resolution: v4.0.0-preview1


Step up your Open Source Security Game with Mend here

CVE-2023-39325 (High) detected in golang.org/x/net-v0.10.0 - autoclosed

CVE-2023-39325 - High Severity Vulnerability

Vulnerable Library - golang.org/x/net-v0.10.0

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.10.0.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/golang.org/x/net/@v/v0.10.0.mod

Dependency Hierarchy:

  • github.com/xmidt-org/candlelight-v0.0.16 (Root Library)
    • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc-v1.14.0
      • google.golang.org/grpc-v1.55.0
        • golang.org/x/net-v0.10.0 (Vulnerable Library)

Found in HEAD commit: 94d3570e83fa1a22f16aee39b04345079cf66b97

Found in base branch: main

Vulnerability Details

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

Publish Date: 2023-10-11

URL: CVE-2023-39325

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://pkg.go.dev/vuln/GO-2023-2102

Release Date: 2023-10-11

Fix Resolution: go1.20.10, go1.21.3, golang.org/x/net - v0.17.0


Step up your Open Source Security Game with Mend here

CVE-2020-29652 (High) detected in github.com/hashicorp/consul-v1.7.0, github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a - autoclosed

CVE-2020-29652 - High Severity Vulnerability

Vulnerable Libraries - github.com/hashicorp/consul-v1.7.0, github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a

github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)
github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a

[mirror] Go supplementary cryptography libraries

Dependency Hierarchy:

  • github.com/xmidt-org/webpa-common-v1.11.6 (Root Library)
    • github.com/hashicorp/consul-v1.7.0
      • github.com/hashicorp/serf-v0.9.4
        • github.com/hashicorp/memberlist-v0.2.2
          • github.com/miekg/dns-v1.1.26
            • github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.

Publish Date: 2020-12-17

URL: CVE-2020-29652

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1

Release Date: 2020-12-17

Fix Resolution: v0.0.0-20201216223049-8b5274cf687f


Step up your Open Source Security Game with Mend here

Petasos may have incorrect sd counts

The issues we've seen with talaria may be affecting petasos. We really need to create a new chart that shows all the petasos SD counts, the same as we already have with talaria.

CVE-2020-8565 (Medium) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2020-8565 - Medium Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

Publish Date: 2020-12-07

URL: CVE-2020-8565

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2020-0064

Release Date: 2020-12-07

Fix Resolution: v1.20.0-alpha.2


Step up your Open Source Security Game with Mend here

Configured defaultScheme is not used at right place.

Hi Team,

I had configured the default scheme as HTTP in petasos and registered talaria without the HTTP scheme in consul. I am able to see my host without scheme in consul catalog API but in petasos, I am getting host with HTTPS

CVE-2020-13949 (High) detected in github.com/open-telemetry/opentelemetry-go-v0.19.0 - autoclosed

CVE-2020-13949 - High Severity Vulnerability

Vulnerable Library - github.com/open-telemetry/opentelemetry-go-v0.19.0

OpenTelemetry Go API and SDK

Dependency Hierarchy:

  • github.com/open-telemetry/opentelemetry-go-v0.19.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.

Publish Date: 2021-02-12

URL: CVE-2020-13949

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://lists.apache.org/thread.html/r43dc2b2e928e9d845b07ac075634cb759d91bb852421dc282f87a74a%40%3Cdev.thrift.apache.org%3E

Release Date: 2021-02-12

Fix Resolution: v0.14.0


Step up your Open Source Security Game with Mend here

CVE-2021-3121 (High) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2021-3121 - High Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

Publish Date: 2021-01-11

URL: CVE-2021-3121

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121

Release Date: 2021-01-11

Fix Resolution: v1.3.2


Step up your Open Source Security Game with Mend here

CVE-2022-21698 (High) detected in github.com/prometheus/client_golang/prometheus/promhttp-v1.1.0

CVE-2022-21698 - High Severity Vulnerability

Vulnerable Library - github.com/prometheus/client_golang/prometheus/promhttp-v1.1.0

Prometheus instrumentation library for Go applications

Dependency Hierarchy:

  • github.com/xmidt-org/webpa-common/server-v1.6.2 (Root Library)
    • github.com/prometheus/client_golang/prometheus/promhttp-v1.1.0 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler* middleware except RequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric with method label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.

Publish Date: 2022-02-15

URL: CVE-2022-21698

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cg3q-j54f-5p7p

Release Date: 2022-02-15

Fix Resolution: v1.11.1


Step up your Open Source Security Game with WhiteSource here

CVE-2019-11250 (Medium) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2019-11250 - Medium Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.

Publish Date: 2019-08-29

URL: CVE-2019-11250

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2020-0065

Release Date: 2020-10-16

Fix Resolution: v1.16.0-beta.1


Step up your Open Source Security Game with Mend here

Petasos needs to be able to redirect based on partner-id

Petasos needs to support redirecting a client request based on a mapping of "partner-id" to "theater" url prior to attempting to resolve the specific talaria. A "theater" is a collection of data centers. Petasos must ensure it does not redirect in a way that causes an infinite redirect loop.

CVE-2022-28948 (High) detected in github.com/go-yaml/yaml-v3.0.0 - autoclosed

CVE-2022-28948 - High Severity Vulnerability

Vulnerable Library - github.com/go-yaml/yaml-v3.0.0

YAML support for the Go language.

Dependency Hierarchy:

  • github.com/xmidt-org/webpa-common-v1.11.6 (Root Library)
    • github.com/stretchr/testify-v1.7.0
      • github.com/go-yaml/yaml-v3.0.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.

Publish Date: 2022-05-19

URL: CVE-2022-28948

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hp87-p4gw-j4gq

Release Date: 2022-05-19

Fix Resolution: 3.0.0


Step up your Open Source Security Game with Mend here

Refactor Large Functions to Improve Readability

Refactor long functions

There are a few long functions that should be refactored and broken up into more readable sections.
By default, the funlen linter has a limit of 60 lines or 40 statements per function. It is the goal to adhere to these standards.
Currently, the funlen linter in this repo is disabled, this should be enabled as part of this issue. It can be enabled by adding it to the enable section of the .golanci.yaml config file.

To Do

  • Enable funlen linter in the .golanci.yaml config file
  • Run the linter golangci-lint run
  • Refactor and break up the functions the linter complains about

Update deprecated libraries

The staticcheck linter checks for deprecated imports. This has been disabled for imports of webpa-common/v2/logging and other libraries, but should be enabled as part of this ticket. A new logger will need to be added.

To Do

  • Search for nolint:staticcheck in the repo and remove the comments
  • Run the linter golangci-lint run
  • Reconfigure logging in those files, most likely using uber/zap
  • Fix other staticcheck deprecated issues that may be in the repo

Improve error logging

For errors encountered, adding the source IP of the client would be helpful when debugging issues.

CVE-2020-13170 (High) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2020-13170 - High Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary data center was not enabled. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

Publish Date: 2020-06-11

URL: CVE-2020-13170

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13170

Release Date: 2020-06-17

Fix Resolution: 1.6.6,1.7.4


Step up your Open Source Security Game with Mend here

CVE-2020-25864 (Medium) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2020-25864 - Medium Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.

Publish Date: 2021-04-20

URL: CVE-2020-25864

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security.archlinux.org/CVE-2020-25864

Release Date: 2021-04-20

Fix Resolution: v1.7.14, v1.8.10, v1.9.5, v1.10.0


Step up your Open Source Security Game with Mend here

CVE-2022-29526 (Medium) detected in github.com/hashicorp/go-sockaddr-v1.0.2 - autoclosed

CVE-2022-29526 - Medium Severity Vulnerability

Vulnerable Library - github.com/hashicorp/go-sockaddr-v1.0.2

IP Address/UNIX Socket convenience functions for Go

Dependency Hierarchy:

  • github.com/xmidt-org/webpa-common-v1.11.9 (Root Library)
    • github.com/hashicorp/consul/api-v1.12.0
      • github.com/hashicorp/serf-v0.9.7
        • github.com/hashicorp/memberlist-v0.3.0
          • github.com/hashicorp/go-sockaddr-v1.0.2 (Vulnerable Library)

Found in HEAD commit: cf637d3e1545598460b8649cf652616dd394d04b

Found in base branch: main

Vulnerability Details

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

Publish Date: 2022-06-23

URL: CVE-2022-29526

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with Mend here

CVE-2022-32149 (High) detected in golang.org/x/text-v0.3.7 - autoclosed

CVE-2022-32149 - High Severity Vulnerability

Vulnerable Library - golang.org/x/text-v0.3.7

Library home page: https://proxy.golang.org/golang.org/x/text/@v/v0.3.7.zip

Dependency Hierarchy:

  • github.com/spf13/viper-v1.13.0 (Root Library)
    • github.com/spf13/afero-v1.9.2
      • golang.org/x/text-v0.3.7 (Vulnerable Library)

Found in HEAD commit: 801b9f3fe069773dfce661cdee5e58d624430563

Found in base branch: main

Vulnerability Details

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

Publish Date: 2022-10-14

URL: CVE-2022-32149

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-32149

Release Date: 2022-10-14

Fix Resolution: v0.3.8


Step up your Open Source Security Game with Mend here

(unify) Fix license errors and enable checking.

Fix license errors and enable checking all the time.

Verify each license and add them to the accepted list.

Enable license checking in the action

In .github.workflows/ci.yml remove the line license-skip: true.

CVE-2022-27191 (High) detected in github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a - autoclosed

CVE-2022-27191 - High Severity Vulnerability

Vulnerable Library - github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a

[mirror] Go supplementary cryptography libraries

Dependency Hierarchy:

  • github.com/xmidt-org/webpa-common-v1.11.6 (Root Library)
    • github.com/hashicorp/consul-v1.7.0
      • github.com/hashicorp/serf-v0.9.4
        • github.com/hashicorp/memberlist-v0.2.2
          • github.com/miekg/dns-v1.1.26
            • github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

Publish Date: 2022-03-18

URL: CVE-2022-27191

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-27191

Release Date: 2022-03-18

Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20220315.3147a52-1;golang-go.crypto-dev - 1:0.0~git20220315.3147a52-1


Step up your Open Source Security Game with Mend here

CVE-2019-11253 (High) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2019-11253 - High Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility.

Publish Date: 2019-10-17

URL: CVE-2019-11253

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: kubernetes/kubernetes#83253

Release Date: 2020-10-02

Fix Resolution: v1.13.12;v1.14.8;v1.15.5;v1.16.2


Step up your Open Source Security Game with Mend here

CVE-2023-2816 (Medium) detected in github.com/hashicorp/Consul/api-v1.20.0 - autoclosed

CVE-2023-2816 - Medium Severity Vulnerability

Vulnerable Library - github.com/hashicorp/Consul/api-v1.20.0

Library home page: https://proxy.golang.org/github.com/hashicorp/consul/api/@v/v1.20.0.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go/pkg/mod/cache/download/github.com/hashicorp/consul/api/@v/v1.20.0.mod

Dependency Hierarchy:

  • github.com/xmidt-org/webpa-common/v2-v2.2.0 (Root Library)
    • github.com/hashicorp/Consul/api-v1.20.0 (Vulnerable Library)

Found in HEAD commit: c4e3d415b3439d7e94da1d6d274688d9697dde8c

Found in base branch: main

Vulnerability Details

Consul and Consul Enterprise allowed any user with service:write permissions to use Envoy extensions configured via service-defaults to patch remote proxy instances that target the configured service, regardless of whether the user has permission to modify the service(s) corresponding to those modified proxies.

Publish Date: 2023-06-02

URL: CVE-2023-2816

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.hashicorp.com/t/hcsec-2023-16-consul-envoy-extension-downstream-proxy-configuration-by-upstream-service-owner/54525

Release Date: 2023-06-02

Fix Resolution: v1.15.3


Step up your Open Source Security Game with Mend here

CVE-2021-32574 (High) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2021-32574 - High Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.

Publish Date: 2021-07-17

URL: CVE-2021-32574

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/hashicorp/consul/releases/tag/v1.10.1

Release Date: 2021-07-17

Fix Resolution: v1.10.1


Step up your Open Source Security Game with Mend here

Log the invalid header value in case of "400 Bad Request: invalid header value"

Observing this 400 error in parodus client and there are many instances of this error in field.

https://splunk.ccp.cable.comcast.com/en-US/app/search/search?q=search%20SYS_ERROR_Parodus_http400%20index%3Drdk-json%20%7C%20stats%20count%20by%20searchResult%7B%7D.mac&display.page.search.mode=smart&dispatch.sample_ratio=1&earliest=-15m&latest=now&display.statistics.sortColumn=count&display.statistics.sortDirection=desc&sid=1536368013.619768_09B47B20-7D32-48EB-9C39-FC9836F25DDE&display.page.search.tab=statistics&display.general.type=statistics

180908-01:15:24.784050 [mod=PARODUS, lvl=INFO] [tid=3604] PARODUS: nopoll_conn.c:285 IPv4 address of fabric.xmidt.comcast.net is 96.116.57.120  
180908-01:15:26.564083 [mod=PARODUS, lvl=ERROR] [tid=3604] PARODUS: nopoll_conn.c:2955 websocket server denied connection with: 400 Bad Request: invalid header value 
180908-01:15:26.564083 [mod=PARODUS, lvl=INFO] [tid=3604] PARODUS: nopoll_conn.c:2962 Received HTTP 400 response from server 
180908-01:15:26.564083 [mod=PARODUS, lvl=INFO] [tid=3604] PARODUS: nopoll_conn.c:2964 conn->handshake->httpStatus: 400 
180908-01:15:26.574083 [mod=PARODUS, lvl=ERROR] [tid=3604] PARODUS: nopoll_conn.c:2802 Received uncomplete listener handshake reply ((nil) 0 1) 
180908-01:15:26.574083 [mod=PARODUS, lvl=INFO] [tid=3604] PARODUS: nopoll_conn.c:5033 nopoll_conn_wait_until_connection_ready() response: status: 400 
180908-01:15:26.574083 [mod=PARODUS, lvl=ERROR] [tid=3604] PARODUS: Client connection timeout
180908-01:15:26.574083 [mod=PARODUS, lvl=ERROR] [tid=3604] PARODUS: RDK-10037 - WebPA Connection Lost

To get to the root cause of this issue please log the invalid header value in petasos logs.

CVE-2021-43565 (High) detected in github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a - autoclosed

CVE-2021-43565 - High Severity Vulnerability

Vulnerable Library - github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a

[mirror] Go supplementary cryptography libraries

Dependency Hierarchy:

  • github.com/xmidt-org/webpa-common-v1.11.6 (Root Library)
    • github.com/hashicorp/consul-v1.7.0
      • github.com/hashicorp/serf-v0.9.4
        • github.com/hashicorp/memberlist-v0.2.2
          • github.com/miekg/dns-v1.1.26
            • github.com/golang/crypto-5c72a883971a4325f8c62bf07b6d38c20ea47a6a (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

There's an input validation flaw in golang.org/x/crypto's readCipherPacket() function. An unauthenticated attacker who sends an empty plaintext packet to a program linked with golang.org/x/crypto/ssh could cause a panic, potentially leading to denial of service.

Publish Date: 2021-11-10

URL: CVE-2021-43565

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43565

Release Date: 2021-11-10

Fix Resolution: golang-golang-x-crypto-dev - 1:0.0~git20211202.5770296-1;golang-go.crypto-dev - 1:0.0~git20211202.5770296-1


Step up your Open Source Security Game with Mend here

CVE-2020-12797 (Medium) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2020-12797 - Medium Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4.

Publish Date: 2020-06-11

URL: CVE-2020-12797

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12797

Release Date: 2020-06-11

Fix Resolution: 1.6.6,1.7.4


Step up your Open Source Security Game with Mend here

CVE-2021-31525 (Medium) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2021-31525 - Medium Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

Publish Date: 2021-05-27

URL: CVE-2021-31525

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1958341

Release Date: 2021-05-27

Fix Resolution: golang - v1.15.12,v1.16.4,v1.17.0


Step up your Open Source Security Game with Mend here

CVE-2022-41723 (High) detected in golang.org/x/net-v0.4.0 - autoclosed

CVE-2022-41723 - High Severity Vulnerability

Vulnerable Library - golang.org/x/net-v0.4.0

[mirror] Go supplementary network libraries

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.4.0.zip

Dependency Hierarchy:

  • github.com/xmidt-org/candlelight-v0.0.14 (Root Library)
    • go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc-v1.13.0
      • google.golang.org/grpc-v1.52.3
        • golang.org/x/net-v0.4.0 (Vulnerable Library)

Found in HEAD commit: 589d4332c5c304f9d0f4b3e866368be402b5483f

Found in base branch: main

Vulnerability Details

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Publish Date: 2022-09-29

URL: CVE-2022-41723

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://osv.dev/vulnerability/GO-2023-1568

Release Date: 2022-09-29

Fix Resolution: v0.7.0


Step up your Open Source Security Game with Mend here

CVE-2020-9283 (High) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2020-9283 - High Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

Publish Date: 2020-02-20

URL: CVE-2020-9283

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9283

Release Date: 2020-02-20

Fix Resolution: github.com/golang/crypto - bac4c82f69751a6dd76e702d54b3ceb88adab236


Step up your Open Source Security Game with Mend here

CVE-2020-12758 (High) detected in github.com/hashicorp/consul-v1.7.0 - autoclosed

CVE-2020-12758 - High Severity Vulnerability

Vulnerable Library - github.com/hashicorp/consul-v1.7.0

Consul is a distributed, highly available, and data center aware solution to connect and configure applications across dynamic, distributed infrastructure.

Dependency Hierarchy:

  • github.com/go-kit/kit-v0.10.0 (Root Library)
    • github.com/hashicorp/consul-v1.7.0 (Vulnerable Library)

Found in HEAD commit: d09bd31bc55e2d781858b9232d53bbc245c9ad6b

Found in base branch: main

Vulnerability Details

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4.

Publish Date: 2020-06-11

URL: CVE-2020-12758

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12758

Release Date: 2020-06-17

Fix Resolution: 1.6.6,1.7.4


Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.