ioana-nicolae/go

GO

go's Issues

github.com/mholt/archiver-v3.5.0: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - github.com/mholt/archiver-v3.5.0

Found in HEAD commit: bcc2412805fb34b5a5c4e623639a0f0a1e3b4fe5

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2021-29482	High	7.5	github.com/ulikunitz/xz-v0.5.7	Transitive	N/A	❌
CVE-2020-16845	High	7.5	github.com/ulikunitz/xz-v0.5.7	Transitive	N/A	❌

Details

CVE-2021-29482

Vulnerable Library - github.com/ulikunitz/xz-v0.5.7

Pure golang package for reading and writing xz-compressed files

Dependency Hierarchy:

• github.com/mholt/archiver-v3.5.0 (Root Library)
  • ❌ github.com/ulikunitz/xz-v0.5.7 (Vulnerable Library)

Found in HEAD commit: bcc2412805fb34b5a5c4e623639a0f0a1e3b4fe5

Found in base branch: main

Vulnerability Details

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input. The problem has been fixed in release v0.5.8. As a workaround users can limit the size of the compressed file input to a reasonable size for their use case. The standard library had recently the same issue and got the CVE-2020-16845 allocated.

Publish Date: 2021-04-28

URL: CVE-2021-29482

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-25xm-hr59-7c27

Release Date: 2021-04-28

Fix Resolution: v0.5.8

CVE-2020-16845

Vulnerable Library - github.com/ulikunitz/xz-v0.5.7

Pure golang package for reading and writing xz-compressed files

Dependency Hierarchy:

• github.com/mholt/archiver-v3.5.0 (Root Library)
  • ❌ github.com/ulikunitz/xz-v0.5.7 (Vulnerable Library)

Found in HEAD commit: bcc2412805fb34b5a5c4e623639a0f0a1e3b4fe5

Found in base branch: main

Vulnerability Details

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Publish Date: 2020-08-06

URL: CVE-2020-16845

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q6gq-997w-f55g

Release Date: 2020-08-06

Fix Resolution: go1.13.15,go1.14.7,github.com/ulikunitz/xz - v0.5.8