-
Notifications
You must be signed in to change notification settings - Fork 73
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix vendored packages and update gopkg.in/yaml.v2 to v2.2.7 (CVE-2019-11253) #29
Conversation
commits f7fe884 and d52f528 enabled go modules and vendored dependencies, but did not include go-spew as a dependency. This was later on addressed by 3f088a4, but did not update the vendored files. This patch is the result of re-running `go mod vendor` to vendor go-spew. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
full diff: go-yaml/yaml@v2.2.2...v2.2.7 includes: - go-yaml/yaml@caeefd8 addresses CVE-2019-11253 JSON/YAML parsing vulnerable to resource exhaustion attack - go-yaml/yaml#171 Tighten restrictions on float decoding - go-yaml/yaml#515 Add large document benchmarks, tune alias heuristic, add max depth limits - go-yaml/yaml@f90ceb4 fixes go-yaml/yaml#529 yaml.Unmarshal crashes on "assignment to entry in nil map" - go-yaml/yaml#543 Port stale simple_keys fix to v2 - go-yaml/yaml@1f64d61 fixes go-yaml/yaml#548 Invalid simple_keys now cause panics later in decode Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
/assign @dims |
/approve thanks @thaJeztah |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dims, thaJeztah The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/hold let's cross check the license |
Good point; thx! Description from GitHub is;
But not a lawyer, so don't know if it's problematic; looks like kubernetes itself does vendor it; https://github.com/kubernetes/kubernetes/tree/master/vendor/github.com/davecgh/go-spew |
perfect! if we are already do it in k/k :) /hold cancel |
for the record : https://github.com/kubernetes/kubernetes/blame/master/vendor/github.com/davecgh/go-spew/LICENSE#L1 it's been there for 2+ years |
commits f7fe884 (#16) and d52f528 () enabled go modules and vendored dependencies, but did not include go-spew as a dependency. This was later on addressed by 3f088a4 (#25), but did not update the vendored files. The first commit is the result of re-running
go mod vendor
to vendor go-spew.The second commit updates gopkg.in/yaml.v2 to v2.2.7, which includes a fix for CVE-2019-11253
full diff: go-yaml/yaml@v2.2.2...v2.2.7
includes:
addresses CVE-2019-11253 JSON/YAML parsing vulnerable to resource exhaustion attack
fixes yaml.Unmarshal crashes on "assignment to entry in nil map" go-yaml/yaml#529 yaml.Unmarshal crashes on "assignment to entry in nil map"
fixes Invalid simple_keys now cause panics later in decode go-yaml/yaml#548 Invalid simple_keys now cause panics later in decode