Vulnerabilities in golang/crypto < 0.35.0 and golang/net < 0.38.0

Open
#87 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
github-actions, go
Domain
ci-cd, security

Research direction

Start by locating the Go dependency declarations for golang.org/x/crypto and golang.org/x/net, then compare their versions with the minimum versions stated in the issue. Update the dependencies and verify that the action still builds and that the listed advisories are no longer present.

Written by the indexing model from the issue text.

Description

Two of the golang packages used in this action contains vulnerabilities. Would really appreciate if these could be patched soon 🙏

uses: appleboy/lambda-action@v0.2.0

Critical severity vulnerabilities .. 🔥

Vulnerability Package
GHSA-v778-237x-gjrc pkg:golang/golang.org/x/crypto@v0.22.0

High severity vulnerabilities .. ⚠️

Vulnerability Package
GHSA-hcg3-q754-cr77 pkg:golang/golang.org/x/crypto@v0.22.0

Medium severity vulnerabilities ..

Vulnerability Package
GHSA-qxp5-gwg8-xv66 pkg:golang/golang.org/x/net@v0.24.0
GHSA-vvgc-356p-c3xw pkg:golang/golang.org/x/net@v0.24.0
Dominant language
D2
Stars
435
Forks
57
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from appleboy/lambda-action

All issues in appleboy/lambda-action

Similar issues

More DevOps issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.