You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This seems to be fixed in main , @SaurabhAhuja1983 I am closing this issue but please comment below if you think this needs to be backported to olderversions. ( Closing this issue but please feel free to re-open ) cc @containers/buildah-maintainers
Description
Steps to reproduce the issue:
Describe the results you received:
{
"Target": "usr/local/bin/buildah",
"Class": "lang-pkgs",
"Type": "gobinary",
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2022-32149",
"PkgName": "golang.org/x/text",
"InstalledVersion": "v0.3.7",
"FixedVersion": "0.3.8",
"Layer": {
"DiffID": "sha256:7ff9a979ef4abd9a5d4bdc6e339afea0a3289c15587181d6ae97c9507ca0ea3c"
},
"SeveritySource": "ghsa",
"PrimaryURL": "https://avd.aquasec.com/nvd/cve-2022-32149",
"DataSource": {
"ID": "go-vulndb",
"Name": "The Go Vulnerability Database",
"URL": "https://github.com/golang/vulndb"
},
"Title": "golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags",
"Description": "An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.",
"Severity": "HIGH",
"CweIDs": [
"CWE-772"
],
"CVSS": {
"ghsa": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"nvd": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
},
"redhat": {
"V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"V3Score": 7.5
}
},
"References": [
"https://access.redhat.com/security/cve/CVE-2022-32149",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32149",
"https://github.com/advisories/GHSA-69ch-w2m2-3vjp",
"https://github.com/golang/go/issues/56152",
"https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c",
"https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c (v0.3.8)",
"https://go.dev/cl/442235",
"https://go.dev/issue/56152",
"https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ",
"https://groups.google.com/g/golang-dev/c/qfPIly0X7aU",
"https://nvd.nist.gov/vuln/detail/CVE-2022-32149",
"https://pkg.go.dev/vuln/GO-2022-1059"
],
"PublishedDate": "2022-10-14T15:15:00Z",
"LastModifiedDate": "2022-10-18T17:41:00Z"
}
]
},
Describe the results you expected:
No vuln's should be reported.
Output of
rpm -q buildah
orapt list buildah
:Output of
buildah version
:Output of
podman version
if reporting apodman build
issue:Output of
cat /etc/*release
:Output of
uname -a
:(paste your output here)
The text was updated successfully, but these errors were encountered: