-
Notifications
You must be signed in to change notification settings - Fork 18.3k
Closed as not planned
Closed as not planned
Copy link
Labels
NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.vulncheck or vulndbIssues for the x/vuln or x/vulndb repoIssues for the x/vuln or x/vulndb repo
Milestone
Description
$ govulncheck ./...
Scanning your code and 2016 packages across 204 dependent modules for known vulnerabilities...
Vulnerability #1: GO-2023-2402
Man-in-the-middle attacker can compromise integrity of secure channel in
golang.org/x/crypto
More info: https://pkg.go.dev/vuln/GO-2023-2402
Module: golang.org/x/crypto
Found in: golang.org/x/crypto@v0.14.0
Fixed in: golang.org/x/crypto@v0.17.0
Example traces found:
#1: test/e2e/framework/ssh/ssh.go:316:33: ssh.runSSHCommandViaBastion calls ssh.Client.Dial
#2: test/e2e/framework/ssh/ssh.go:329:35: ssh.runSSHCommandViaBastion calls ssh.Client.NewSession
#3: test/e2e/framework/ssh/ssh.go:301:32: ssh.runSSHCommandViaBastion calls ssh.Dial
#4: test/e2e/framework/ssh/ssh.go:326:25: ssh.runSSHCommandViaBastion calls ssh.NewClient
#5: test/e2e/framework/ssh/ssh.go:322:44: ssh.runSSHCommandViaBastion calls ssh.NewClientConn
#6: test/e2e/framework/ssh/ssh.go:333:2: ssh.runSSHCommandViaBastion calls ssh.Session.Close
#7: test/e2e/framework/ssh/ssh.go:339:22: ssh.runSSHCommandViaBastion calls ssh.Session.Run
#8: test/e2e/framework/ssh/ssh.go:320:2: ssh.runSSHCommandViaBastion calls ssh.channel.Close
#9: test/utils/harness/harness.go:54:14: harness.Harness.Close calls ssh.stdin, which calls ssh.channel.CloseWrite
#10: cmd/kubeadm/app/preflight/checks.go:339:18: preflight.FileContentCheck.Check calls io.Copy, which eventually calls ssh.channel.Read
#11: cmd/kubeadm/app/preflight/checks.go:544:13: preflight.SystemVerificationCheck.Check calls bufio.Writer.Flush, which calls ssh.channel.Write
#12: cmd/kubeadm/app/preflight/checks.go:339:18: preflight.FileContentCheck.Check calls io.Copy, which eventually calls ssh.extChannel.Read
Your code is affected by 1 vulnerability from 1 module.
Share feedback at https://go.dev/s/govulncheck-feedback.
There are doubts about the next three traces found
calls io.Copy, which eventually calls ssh.channel.Read
calls bufio.Writer.Flush, which calls ssh.channel.Write
calls io.Copy, which eventually calls ssh.extChannel.Read
neolit123 and rlsvarinskis
Metadata
Metadata
Assignees
Labels
NeedsInvestigationSomeone must examine and confirm this is a valid issue and not a duplicate of an existing one.Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.vulncheck or vulndbIssues for the x/vuln or x/vulndb repoIssues for the x/vuln or x/vulndb repo