mohib-hub / beego Goto Github PK

Vulnerable Library - gopkg.in/yaml.v2-v2.2.1

YAML support for the Go language.

Dependency Hierarchy:

• ❌ gopkg.in/yaml.v2-v2.2.1 (Vulnerable Library)

Found in HEAD commit: f889a177aceddf9278368bc869d16516fdc46927

Found in base branch: develop

Vulnerability Details

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

Publish Date: 2020-04-01

URL: CVE-2019-11254

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://github.com/go-yaml/yaml/tree/v2.2.8

Release Date: 2020-04-01

Fix Resolution: v2.2.8

Vulnerable Library - github.com/cloudflare/golz4-ef862a3cdc58a6f1fee4e3af3d44fbe279194cde

Golang interface to LZ4 compression

Dependency Hierarchy:

• ❌ github.com/cloudflare/golz4-ef862a3cdc58a6f1fee4e3af3d44fbe279194cde (Vulnerable Library)

Found in HEAD commit: f889a177aceddf9278368bc869d16516fdc46927

Found in base branch: develop

Vulnerability Details

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Publish Date: 2019-10-14

URL: CVE-2019-17543

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17543

Release Date: 2019-10-14

Fix Resolution: 1.9.2