Referenced library at go.sum: CVE-2020-26160

[odacremolbap]

There is an indirect library referenced at go.sum that has been flagged at CVE-2020-26160

pkg/go.sum

Line 136 in a00ba48

github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=

It should be tracked to find the direct dependencies that use it and upgrade them.

/kind bug
/kind cleanup

[markusthoemmes]

This has been fixed quite a while ago. go.sum is not indicative of the dependencies actually used, go.mod is (I believe).

[odacremolbap]

I think this is a transient dependency, by issuing a go mod graph there seems to be a couple paths to pkg importing the library.
I'll check if this has been a concern at kubernetes.

github.com/spf13/viper@v1.7.0 github.com/dgrijalva/jwt-go@v3.2.0+incompatible
github.com/spf13/cobra@v1.1.1 github.com/spf13/viper@v1.7.0
go.etcd.io/etcd@v0.5.0-alpha.5.0.20200910180754-dd1b699fc489 github.com/spf13/cobra@v0.0.3
k8s.io/apiserver@v0.21.4 go.etcd.io/etcd@v0.5.0-alpha.5.0.20200910180754-dd1b699fc489
k8s.io/apiextensions-apiserver@v0.21.4 github.com/spf13/cobra@v1.1.1
k8s.io/apiextensions-apiserver@v0.21.4 go.etcd.io/etcd@v0.5.0-alpha.5.0.20200910180754-dd1b699fc489
go.etcd.io/etcd@v0.5.0-alpha.5.0.20200910180754-dd1b699fc489 github.com/dgrijalva/jwt-go@v3.2.0+incompatible

[markusthoemmes]

It has, yes. I myself have contributed one of the necessary fixes in kubernetes/kubernetes#95692 and another was kubernetes/kubernetes#102755. Note that neither remove the respective dependency from go.sum but only from go.mod and modules.txt. Not active code in Knative is importing github.com/dgrijalva/jwt-go either directly or transitively.

[odacremolbap]

Yes, the code should not be used here, but a vulnerability analysis might flag all sources importing it.
I think that comes from cobra dependency at apiextensions, I'll close this issue since the action seems to be somewhere else.

Thanks for clarifying.

[markusthoemmes]

FWIW, neither snyk nor Github Security is flagging our repos, so I think we're golden.