Vulnerability of dependency "golang.org/x/net"

Question

Vulnerability of dependency "golang.org/x/net"

Silence-worker-02 opened this issue a year ago · comments

Hello, we are a team researching the dependency management mechanism of Golang. During our analysis, we came across your project and noticed that it contains a vulnerability (CVE-2022-41723). In your project, the golang.org/x/net package is being used at version golang.org/x/net v0.0.0-20220520000938-2e3eb7b945c2, but the patched version is v0.7.0. To fix the vulnerability, we recommend modifying the go.mod file to update the version to v0.7.0. Thank you for your attention to this matter.

Research of Golang · Answer 1 · Thu Jul 13 2023 20:56:19 GMT+0800 (China Standard Time)

We also came across your project and noticed that it contains a vulnerability (CVE-2022-32149). In your project, the golang.org/x/text package is being used at version golang.org/x/text v0.3.7, but the patched version is v0.3.8. To fix the vulnerability, we recommend modifying the go.mod file to update the version to v0.3.8 or higher. Thank you for your attention to this matter.

bucketcat · Answer 2 · Wed Dec 06 2023 06:00:46 GMT+0800 (China Standard Time)

Any reason why Dependabot (properly configured for Go) isn't picking up on this?

Edit: Because x/Net is being inherited through the x wildcard. Adding x/Net to go.mod caused it to instantly pick up on it.

This is maybe an issue with Dependabot not going through all sub packages and lazy developers importing entire packages rather than being narrow.