Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

go.mod: Update dependencies #2607

Merged
merged 1 commit into from
Dec 12, 2022
Merged

go.mod: Update dependencies #2607

merged 1 commit into from
Dec 12, 2022

Conversation

mrueg
Copy link
Contributor

@mrueg mrueg commented Dec 11, 2022

This PR is modernizing dependencies, which a lot had updates available.

@fujita
Copy link
Member

fujita commented Dec 12, 2022

Any reason to be updated for such as security bugs?

@mrueg
Copy link
Contributor Author

mrueg commented Dec 12, 2022

to my knowledge just informational ones (checked with govulncheck).

=== Informational ===

The vulnerabilities below are in packages that you import, but your code
doesn't appear to call any vulnerable functions. You may not need to take any
action. See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck
for details.

Vulnerability #1: GO-2022-1059
  An attacker may cause a denial of service by crafting an
  Accept-Language header which ParseAcceptLanguage will take
  significant time to parse.
  Found in: golang.org/x/text/language@v0.3.7
  Fixed in: golang.org/x/text/language@v0.3.8
  More info: https://pkg.go.dev/vuln/GO-2022-1059

Vulnerability #2: GO-2022-0969
  HTTP/2 server connections can hang forever waiting for a clean
  shutdown that was preempted by a fatal error. This condition can
  be exploited by a malicious client to cause a denial of service.
  Found in: golang.org/x/net/http2@v0.0.0-20220225172249-27dd8689420f
  Fixed in: golang.org/x/net/http2@v0.0.0-20220906165146-f3363e06e74c
  More info: https://pkg.go.dev/vuln/GO-2022-0969

Vulnerability #3: GO-2022-0493
  When called with a non-zero flags parameter, the Faccessat
  function can incorrectly report that a file is accessible.
  Found in: golang.org/x/sys/unix@v0.0.0-20211216021012-1d35b9e2eb4e
  Fixed in: golang.org/x/sys/unix@v0.0.0-20220412211240-33da011f77ad
  More info: https://pkg.go.dev/vuln/GO-2022-0493

@fujita fujita merged commit f0b3ed1 into osrg:master Dec 12, 2022
@fujita
Copy link
Member

fujita commented Dec 12, 2022

Thanks, pushed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants