Skip to content

Commit a72da1c

Browse files
mergify[bot]zmoogclaude
authored
[8.19](backport #50215) security: bump aws-sdk-go-v2 cloudwatchlogs to fix GHSA-xmrv-pmrh-hhx2 (#50307)
* security: bump aws-sdk-go-v2 cloudwatchlogs to fix GHSA-xmrv-pmrh-hhx2 (#50215) ## Summary - Bumps `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs` from v1.50.2 → v1.65.0 The other two affected packages from GHSA-xmrv-pmrh-hhx2 were already resolved on main: - `aws/protocol/eventstream` was already at the patched version v1.7.8 - `service/s3` was already bumped to v1.98.0 (≥ v1.97.3 fix) on main Addresses [GHSA-xmrv-pmrh-hhx2](GHSA-xmrv-pmrh-hhx2): a Denial-of-Service vulnerability in the EventStream header decoder where a malformed response frame with a crafted header value type byte outside the valid range causes the host process to terminate. Related: https://github.com/elastic/security/issues/9748 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> (cherry picked from commit 7da25cf) * update go.mod, go.sum, NOTICE.txt after cloudwatchlogs bump Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Maurizio Branca <maurizio.branca@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 963b2ac commit a72da1c

4 files changed

Lines changed: 27 additions & 20 deletions

File tree

‎NOTICE.txt‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3115,11 +3115,11 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
31153115

31163116
--------------------------------------------------------------------------------
31173117
Dependency : github.com/aws/aws-sdk-go-v2
3118-
Version: v1.41.4
3118+
Version: v1.41.5
31193119
Licence type (autodetected): Apache-2.0
31203120
--------------------------------------------------------------------------------
31213121

3122-
Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2@v1.41.4/LICENSE.txt:
3122+
Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2@v1.41.5/LICENSE.txt:
31233123

31243124

31253125
Apache License
@@ -4811,11 +4811,11 @@ Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2/servi
48114811

48124812
--------------------------------------------------------------------------------
48134813
Dependency : github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs
4814-
Version: v1.50.2
4814+
Version: v1.65.0
48154815
Licence type (autodetected): Apache-2.0
48164816
--------------------------------------------------------------------------------
48174817

4818-
Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.50.2/LICENSE.txt:
4818+
Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs@v1.65.0/LICENSE.txt:
48194819

48204820

48214821
Apache License
@@ -41053,11 +41053,11 @@ Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2/aws/p
4105341053

4105441054
--------------------------------------------------------------------------------
4105541055
Dependency : github.com/aws/aws-sdk-go-v2/internal/configsources
41056-
Version: v1.4.20
41056+
Version: v1.4.21
4105741057
Licence type (autodetected): Apache-2.0
4105841058
--------------------------------------------------------------------------------
4105941059

41060-
Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.20/LICENSE.txt:
41060+
Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2/internal/configsources@v1.4.21/LICENSE.txt:
4106141061

4106241062

4106341063
Apache License
@@ -41265,11 +41265,11 @@ Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2/inter
4126541265

4126641266
--------------------------------------------------------------------------------
4126741267
Dependency : github.com/aws/aws-sdk-go-v2/internal/endpoints/v2
41268-
Version: v2.7.20
41268+
Version: v2.7.21
4126941269
Licence type (autodetected): Apache-2.0
4127041270
--------------------------------------------------------------------------------
4127141271

41272-
Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.20/LICENSE.txt:
41272+
Contents of probable licence file $GOMODCACHE/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2@v2.7.21/LICENSE.txt:
4127341273

4127441274

4127541275
Apache License

‎changelog/fragments/1776709378-bump-aws-sdk-go-v2-cloudwatchlogs-s3-ghsa-xmrv-pmrh-hhx2.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
kind: security
2+
3+
summary: Bump aws-sdk-go-v2/service/cloudwatchlogs to v1.65.0 to fix GHSA-xmrv-pmrh-hhx2
4+
5+
component: all
6+
7+
pr: https://github.com/elastic/beats/pull/50215

‎go.mod‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,11 @@ require (
2222
github.com/akavel/rsrc v0.8.0 // indirect
2323
github.com/apoydence/eachers v0.0.0-20181020210610-23942921fe77 // indirect
2424
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5
25-
github.com/aws/aws-sdk-go-v2 v1.41.4
25+
github.com/aws/aws-sdk-go-v2 v1.41.5
2626
github.com/aws/aws-sdk-go-v2/config v1.32.12
2727
github.com/aws/aws-sdk-go-v2/credentials v1.19.12
2828
github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.45.2
29-
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.50.2
29+
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.65.0
3030
github.com/aws/aws-sdk-go-v2/service/costexplorer v1.51.1
3131
github.com/aws/aws-sdk-go-v2/service/ec2 v1.277.0
3232
github.com/aws/aws-sdk-go-v2/service/elasticloadbalancingv2 v1.45.4
@@ -292,8 +292,8 @@ require (
292292
github.com/armon/go-radix v1.0.0 // indirect
293293
github.com/aws/aws-msk-iam-sasl-signer-go v1.0.4 // indirect
294294
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
295-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 // indirect
296-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 // indirect
295+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
296+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
297297
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect
298298
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.21 // indirect
299299
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect

‎go.sum‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -181,8 +181,8 @@ github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPd
181181
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
182182
github.com/aws/aws-msk-iam-sasl-signer-go v1.0.4 h1:2jAwFwA0Xgcx94dUId+K24yFabsKYDtAhCgyMit6OqE=
183183
github.com/aws/aws-msk-iam-sasl-signer-go v1.0.4/go.mod h1:MVYeeOhILFFemC/XlYTClvBjYZrg/EPd3ts885KrNTI=
184-
github.com/aws/aws-sdk-go-v2 v1.41.4 h1:10f50G7WyU02T56ox1wWXq+zTX9I1zxG46HYuG1hH/k=
185-
github.com/aws/aws-sdk-go-v2 v1.41.4/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
184+
github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
185+
github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
186186
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
187187
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
188188
github.com/aws/aws-sdk-go-v2/config v1.32.12 h1:O3csC7HUGn2895eNrLytOJQdoL2xyJy0iYXhoZ1OmP0=
@@ -193,10 +193,10 @@ github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 h1:zOgq3uezl5nznfoK3ODuqb
193193
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20/go.mod h1:z/MVwUARehy6GAg/yQ1GO2IMl0k++cu1ohP9zo887wE=
194194
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.79 h1:mGo6WGWry+s5GEf2GLfw3zkHad109FQmtvBV3VYQ8mA=
195195
github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.79/go.mod h1:siwnpWxHYFSSge7Euw9lGMgQBgvRyym352mCuGNHsMQ=
196-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 h1:CNXO7mvgThFGqOFgbNAP2nol2qAWBOGfqR/7tQlvLmc=
197-
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20/go.mod h1:oydPDJKcfMhgfcgBUZaG+toBbwy8yPWubJXBVERtI4o=
198-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 h1:tN6W/hg+pkM+tf9XDkWUbDEjGLb+raoBMFsTodcoYKw=
199-
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20/go.mod h1:YJ898MhD067hSHA6xYCx5ts/jEd8BSOLtQDL3iZsvbc=
196+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
197+
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
198+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
199+
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
200200
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 h1:qYQ4pzQ2Oz6WpQ8T3HvGHnZydA72MnLuFK9tJwmrbHw=
201201
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6/go.mod h1:O3h0IK87yXci+kg6flUKzJnWeziQUKciKrLjcatSNcY=
202202
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.21 h1:SwGMTMLIlvDNyhMteQ6r8IJSBPlRdXX5d4idhIGbkXA=
@@ -207,8 +207,8 @@ github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.28.3 h1:8frWkH+rWP1joKQlWJe
207207
github.com/aws/aws-sdk-go-v2/service/apigatewayv2 v1.28.3/go.mod h1:7M/THRNcz6t6fMas6nZ/ldxGM/Dx2BWGRRcSJxn6X7o=
208208
github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.45.2 h1:pc8D62wqqWtXlIFp5/e/rhpVPxWnA0craqovONbol5M=
209209
github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.45.2/go.mod h1:W6zagkMLyJeopkbOOzERmC4tTQD2I3vdrpw30ywOeEU=
210-
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.50.2 h1:3/bbtfzzGkbhzMUBCwX4BcfBx7YDDjENC2sZvIySKa0=
211-
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.50.2/go.mod h1:Wd99awP91azT7t59fylEjtBYazJvNAneRveTthS7g/0=
210+
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.65.0 h1:3yaFbUbuLfN8n1q01wZtQtHRzUDc/jm0VvniMY0IPE8=
211+
github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs v1.65.0/go.mod h1:PobeppEnIjw4pcgjFryNDZCTH7AiqZw0yb5r98Gvf9c=
212212
github.com/aws/aws-sdk-go-v2/service/costexplorer v1.51.1 h1:JbMktMCPMjlTwzmy0naf32foE8sRqhhF168INXesYcM=
213213
github.com/aws/aws-sdk-go-v2/service/costexplorer v1.51.1/go.mod h1:KHj6GnIt74Ke10Z4kRFDoEvldmSA6mkYJMy804s9E7E=
214214
github.com/aws/aws-sdk-go-v2/service/ec2 v1.277.0 h1:RHJSkRXDGkAKrV4CTEsZsZkOmSpxXKO4aKx4rXd94K4=

0 commit comments

Comments
 (0)