You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@skywalking.apache.org by GitBox <gi...@apache.org> on 2022/04/22 03:44:12 UTC
[GitHub] [skywalking-cli] kezhenxu94 opened a new pull request, #148: Upgrade crypto lib to fix cve
kezhenxu94 opened a new pull request, #148:
URL: https://github.com/apache/skywalking-cli/pull/148
Also add .vscode to .gitignore
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-cli] kezhenxu94 commented on pull request #148: Upgrade crypto lib to fix cve
Posted by GitBox <gi...@apache.org>.
kezhenxu94 commented on PR #148:
URL: https://github.com/apache/skywalking-cli/pull/148#issuecomment-1105973367
FYI CVE
```
+---------------------+------------------+----------+------------------------------------+-----------------------------------+---------------------------------------+
| LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE |
+---------------------+------------------+----------+------------------------------------+-----------------------------------+---------------------------------------+
| golang.org/x/crypto | CVE-2022-27191 | HIGH | v0.0.0-20201216223049-8b5274cf687f | 0.0.0-20220315160706-3147a52a75dd | golang: crash in a |
| | | | | | golang.org/x/crypto/ssh server |
| | | | | | -->avd.aquasec.com/nvd/cve-2022-27191 |
+---------------------+------------------+----------+------------------------------------+-----------------------------------+---------------------------------------+
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-cli] kezhenxu94 commented on a diff in pull request #148: Upgrade crypto lib to fix cve
Posted by GitBox <gi...@apache.org>.
kezhenxu94 commented on code in PR #148:
URL: https://github.com/apache/skywalking-cli/pull/148#discussion_r855744720
##########
go.mod:
##########
@@ -16,7 +16,10 @@ require (
github.com/sirupsen/logrus v1.7.0
github.com/spf13/viper v1.7.0
github.com/urfave/cli/v2 v2.3.0
- golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f // indirect
+ golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 // indirect
Review Comment:
This is not the only missing case, we have lots of indirect dependencies missing in the dist/LICENSE file and that needs an overhaul before next release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-cli] kezhenxu94 merged pull request #148: Upgrade crypto lib to fix cve
Posted by GitBox <gi...@apache.org>.
kezhenxu94 merged PR #148:
URL: https://github.com/apache/skywalking-cli/pull/148
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-cli] kezhenxu94 commented on a diff in pull request #148: Upgrade crypto lib to fix cve
Posted by GitBox <gi...@apache.org>.
kezhenxu94 commented on code in PR #148:
URL: https://github.com/apache/skywalking-cli/pull/148#discussion_r855744720
##########
go.mod:
##########
@@ -16,7 +16,10 @@ require (
github.com/sirupsen/logrus v1.7.0
github.com/spf13/viper v1.7.0
github.com/urfave/cli/v2 v2.3.0
- golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f // indirect
+ golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 // indirect
Review Comment:
This is not the only missing case, we have lots of **indirect** dependencies (in go.sum) missing in the dist/LICENSE file and that needs an overhaul before next release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [skywalking-cli] wu-sheng commented on a diff in pull request #148: Upgrade crypto lib to fix cve
Posted by GitBox <gi...@apache.org>.
wu-sheng commented on code in PR #148:
URL: https://github.com/apache/skywalking-cli/pull/148#discussion_r855743912
##########
go.mod:
##########
@@ -16,7 +16,10 @@ require (
github.com/sirupsen/logrus v1.7.0
github.com/spf13/viper v1.7.0
github.com/urfave/cli/v2 v2.3.0
- golang.org/x/crypto v0.0.0-20201216223049-8b5274cf687f // indirect
+ golang.org/x/crypto v0.0.0-20220411220226-7b82a4e95df4 // indirect
Review Comment:
This lib seems not existing in https://github.com/apache/skywalking-cli/blob/master/dist/LICENSE
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@skywalking.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org