1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
|
#####
# Testing that govulncheck doesn't mention calls when it doesn't have the relevant info
$ govulncheck -scan package -C ${moddir}/multientry . --> FAIL 3
Scanning your code and P packages across M dependent modules for known vulnerabilities...
=== Package Results ===
Vulnerability #1: GO-2021-0113
Due to improper index calculation, an incorrectly formatted language tag can
cause Parse to panic via an out of bounds read. If Parse is used to process
untrusted user inputs, this may be used as a vector for a denial of service
attack.
More info: https://pkg.go.dev/vuln/GO-2021-0113
Module: golang.org/x/text
Found in: golang.org/x/text@v0.3.5
Fixed in: golang.org/x/text@v0.3.7
Your code may be affected by 1 vulnerability.
This scan also found 1 vulnerability in modules you require.
Use '-scan symbol' for more fine grained vulnerability detection and '-show
verbose' for more details.
#####
# Test for package level scan with the -show verbose flag
$ govulncheck -show verbose -scan package -C ${moddir}/multientry . --> FAIL 3
Scanning your code and P packages across M dependent modules for known vulnerabilities...
=== Package Results ===
Vulnerability #1: GO-2021-0113
Due to improper index calculation, an incorrectly formatted language tag can
cause Parse to panic via an out of bounds read. If Parse is used to process
untrusted user inputs, this may be used as a vector for a denial of service
attack.
More info: https://pkg.go.dev/vuln/GO-2021-0113
Module: golang.org/x/text
Found in: golang.org/x/text@v0.3.5
Fixed in: golang.org/x/text@v0.3.7
=== Module Results ===
Vulnerability #1: GO-2022-0969
HTTP/2 server connections can hang forever waiting for a clean shutdown that
was preempted by a fatal error. This condition can be exploited by a
malicious client to cause a denial of service.
More info: https://pkg.go.dev/vuln/GO-2022-0969
Standard library
Found in: net/http@go1.18
Fixed in: net/http@go1.18.6
Your code may be affected by 1 vulnerability.
This scan also found 1 vulnerability in modules you require.
Use '-scan symbol' for more fine grained vulnerability detection.
|
