Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: bump golang.org/x/net to v0.33.0 to mitigate CVE-2024-45338 #234

Merged
merged 1 commit into from
Dec 20, 2024

Conversation

zhiying-lin
Copy link
Contributor

What type of PR is this?

/kind bug

What this PR does / why we need it:

Which issue(s) this PR fixes:
There is a new CVE CVE-2024-45338 published yesterday marked with HIGH severity. This CVE impacts the low-level library golang/x/net, which is again, widely used by most components that have network access.

This CVE affects the code path on the golang.org/x/net/html package, on the API calls Parse/ParseXXX functions. This CVE is exploitable if your code is taking direct user input and feeding to the x/net/html function. The previous implementation is subject to denial-of-service attack for handling huge payload with the strings.ToLower call.

Fixes #

Requirements:

How has this code been tested

Special notes for your reviewer

Copy link

codecov bot commented Dec 20, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.68%. Comparing base (5465567) to head (d6e71ac).
Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #234      +/-   ##
==========================================
+ Coverage   79.66%   79.68%   +0.02%     
==========================================
  Files          27       27              
  Lines        3840     3840              
==========================================
+ Hits         3059     3060       +1     
+ Misses        625      623       -2     
- Partials      156      157       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@ryanzhang-oss ryanzhang-oss merged commit a3d3bd7 into Azure:main Dec 20, 2024
10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants