Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CD] Whitesource Scan - Updated golang.org/x/crypto & golang.org/x/net #1005

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

YangShyrMei
Copy link
Collaborator

Issue - https://github.ibm.com/IBMPrivateCloud/roadmap/issues/66049

CVE-2025-22870 of medium sev states that In Go net/http, x/net/proxy, x/net/http/httpproxy there is a proxy bypass vulnerability using IPv6 zone IDs. Matching of hosts against proxy patterns could improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable was set to "*.example.com", a request to "[::1%25.example.com]:80 would incorrectly match and not be proxied. This affects versions before 1.23.7 and 1.24.x before 1.24.1. The suggested fix is to move to v0.37.0

CVE-2025-22869 of high sev states that SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. The suggested fix is to move to v0.36.0

@ibm-ci-bot ibm-ci-bot requested a review from rwhundley March 26, 2025 05:41
@ibm-ci-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: YangShyrMei
Once this PR has been reviewed and has the lgtm label, please assign yannizhang2019 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ibm-ci-bot ibm-ci-bot requested a review from Tirumalavasa March 26, 2025 05:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants