Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/net: module depends on vulnerable version of x/text@v0.3.0 #40597

Closed
jasdel opened this issue Aug 6, 2020 · 2 comments
Closed

x/net: module depends on vulnerable version of x/text@v0.3.0 #40597

jasdel opened this issue Aug 6, 2020 · 2 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Unreleased

Comments

@jasdel
Copy link
Contributor

jasdel commented Aug 6, 2020

What version of Go are you using (go version)?

go version go1.14 darwin/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/jasdel/Library/Caches/go-build"
GOENV="/Users/jasdel/Library/Application Support/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/jasdel/workspace/golang"
GOPRIVATE=""
GOPROXY="direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/jasdel/workspace/sdk/aws-sdk-go-v2/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/zn/blg7pz1d5z78rx6ft728rb21ynfdwy/T/go-build723822923=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

The golang.org/x/net@latest module has a dependency on golang.org/x/text@v0.3.0 module which has a known vulnerability, CVE-2020-14040. golang.org/x/text tag v0.3.3 resolves the issue.

I help maintain a library that has a dependency on on golang.org/x/net, and the CVE for golang.org/x/text@v0.3.0 is getting flagged as a vulnerability for users of the library i help maintain, aws/aws-sdk-go#3457. The best workaround I think I can suggest for users is to add a replace statement in their application's go.mod until golang.org/x/net is updated.

go mod edit --replace=golang.org/x/text@v0.3.0=golang.org/x/text@v0.3.3

What did you expect to see?

The golang.org/x/net/@latest module depend on golang.org/x/text@v0.3.3.

PR golang/net#77 updates the golang.org/x/net module, but looks like may not of been accepted due to the May - July code freeze.

What did you see instead?

golang.org/x/net@latest depends on golang.org/x/text@v0.3.0
@gopherbot gopherbot added this to the Unreleased milestone Aug 6, 2020
@golang golang deleted a comment Aug 6, 2020
@toothrot toothrot changed the title x/net depends on vulnerable version v0.3.0 x/text x/net: module depends on vulnerable version of x/text@v0.3.0 Aug 7, 2020
@toothrot
Copy link
Contributor

toothrot commented Aug 7, 2020

/cc @bradfitz @ianlancetaylor

@toothrot toothrot added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Aug 7, 2020
@jasdel
Copy link
Contributor Author

jasdel commented Nov 17, 2020

Looks like this issue can be closed, because the golang.org/x/net go.sum was updated in golang/net@a7d1128

@jasdel jasdel closed this as completed Nov 17, 2020
@golang golang locked and limited conversation to collaborators Nov 17, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Unreleased
Development

No branches or pull requests
3 participants
@toothrot @jasdel @gopherbot