Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/build: update to (GO-2021-0113) #51565

hyangah opened this issue Mar 9, 2022 · 3 comments

x/build: update to (GO-2021-0113) #51565

hyangah opened this issue Mar 9, 2022 · 3 comments
Builders NeedsFix


Copy link

@hyangah hyangah commented Mar 9, 2022

govulncheck reports GO-2021-0113 for (as of 2022/03/09)

$ govulncheck ./...
Findings for vulnerability: GO-2021-0113 (CVE-2021-38561):

Trace: (/Users/hakim/go/pkg/mod/ (-) (-) (-) (-) (-)

I don't think this vulnerability is actually affecting this specific code path picked by govulncheck
(The pgconn maintainer also said in jackc/pgconn#103 this vulnerability doesn't affect the package.)

This vulnerability is not the type of vulnerability that can be analyzed with simple(?) callgraph analysis. We need data analysis to see what's fed into the vulnerable function. But with the lack of options to suppress the report, the easiest path forward is, I think, to update the dependency.

On the other hand, as seen in #51216, the Go security team wants to avoid changes triggered by false positive reports. So, I am not sure what's the Go team's policy in cases like this.

If we decide to update the dependency, now the question is which dependency to upgrade:

  • update to as the GO-2021-0113 page implies.
  • update the direct dependency, too:

cc @golang/security

@gopherbot gopherbot added the Builders label Mar 9, 2022
@gopherbot gopherbot added this to the Unreleased milestone Mar 9, 2022
Copy link

@dmitshur dmitshur commented Mar 9, 2022

I'm not sure what the policy should be. For this particular case, it's not a problem to update to the latest pgconn and x/text it in x/build, so I'll add NeedsFix for now.
(If we get more reports that are false positives, that might be a good time to think more, but this is the first one I'm seeing.)

@dmitshur dmitshur added the NeedsFix label Mar 9, 2022
Copy link

@gopherbot gopherbot commented Mar 9, 2022

Change mentions this issue: go.mod: update dependency

gopherbot pushed a commit to golang/build that referenced this issue Mar 9, 2022
This upgrades to v0.3.7 and
suppresses govulncheck's report on GO-2021-0113

For golang/go#51565

Change-Id: I21ec6a3772b455c88a418087b4fbf3cabc1ecc65
Trust: Hyang-Ah Hana Kim <>
Run-TryBot: Hyang-Ah Hana Kim <>
Reviewed-by: Dmitri Shuralyov <>
TryBot-Result: Gopher Robot <>
Reviewed-by: Carlos Amedee <>
Copy link
Contributor Author

@hyangah hyangah commented Mar 9, 2022

I will close this issue - two followup issues were filed.
And, we updated the dependency, not only x/text dependency.

@hyangah hyangah closed this as completed Mar 9, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Builders NeedsFix
None yet

No branches or pull requests

3 participants