Comments (4)
This is full report on waved
mlops-wave/venv/waved (gobinary)
================================
Total: 6 (UNKNOWN: 2, LOW: 0, MEDIUM: 2, HIGH: 2, CRITICAL: 0)
┌────────────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬─────────────────┬─────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────┼─────────────────────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2023-45288 │ MEDIUM │ fixed │ v0.22.0 │ 0.23.0 │ golang: net/http, x/net/http2: unlimited number of │
│ │ │ │ │ │ │ CONTINUATION frames causes DoS │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-45288 │
├────────────────────────────┼────────────────┤ ├──────────┼───────────────────┼─────────────────┼─────────────────────────────────────────────────────────────┤
│ gopkg.in/square/go-jose.v2 │ CVE-2024-28180 │ │ affected │ v2.6.0 │ │ jose-go: improper handling of highly compressed data │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-28180 │
├────────────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼─────────────────┼─────────────────────────────────────────────────────────────┤
│ stdlib │ CVE-2023-45288 │ HIGH │ fixed │ 1.22.1 │ 1.21.9, 1.22.2 │ golang: net/http, x/net/http2: unlimited number of │
│ │ │ │ │ │ │ CONTINUATION frames causes DoS │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-45288 │
│ ├────────────────┤ │ │ ├─────────────────┼─────────────────────────────────────────────────────────────┤
│ │ CVE-2024-24788 │ │ │ │ 1.22.3 │ golang: net: malformed DNS message can cause infinite loop │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24788 │
│ ├────────────────┼──────────┤ │ ├─────────────────┼─────────────────────────────────────────────────────────────┤
│ │ CVE-2024-24789 │ UNKNOWN │ │ │ 1.21.11, 1.22.4 │ The archive/zip package's handling of certain types of │
│ │ │ │ │ │ │ invalid zip fil ...... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24789 │
│ ├────────────────┤ │ │ │ ├─────────────────────────────────────────────────────────────┤
│ │ CVE-2024-24790 │ │ │ │ │ The various Is methods (IsPrivate, IsLoopback, etc) did not │
│ │ │ │ │ │ │ work as ex... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24790 │
└────────────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴─────────────────┴─────────────────────────────────────────────────────────────┘
More we can fix the better
from wave.
Fixed in a90b902.
Bumped Go to 1.22.4 which should mitigate all the CVEs mentioned above. If not, let me know.
from wave.
Edit: Didn't notice your comment @jakubhava.
gopkg.in/square/go-jose.v2
Has no fix atm if I read it correctly.
golang.org/x/net
Will bump and cut one more release.
from wave.
Thanks a lot @mturoci.
from wave.
Related Issues (20)
- Markdown table formatting has been broken HOT 4
- New values in ui.combobox trigger a button submission
- A ValueError is thrown if the websocket message from the client contains data with spaces
- wavedb not included in build releases (that I can see) HOT 2
- Give all widgets the name parameter HOT 3
- Line plot and step plot draw wrong lines in output when changed via data[-1]
- Support data buffers in tables (same as plots)
- wave.Error: unknown format: 17 HOT 1
- Regression from earlier version, aria-colindex missing from table HOT 2
- Regression from earlier version, inline Buttons are misplaced HOT 3
- Set the Value in a Chatbot Card
- Triggers interrupting Chat Value
- Allow turning off fuzzy matching for dropdown search
- Allow Wildcard for H2O_WAVE_ALLOWED_ORIGINS
- Render newlines and multiple spaces in tables
- ui.table / ui.progress_table_cell_type has floating point rounding issues
- Possible bug when updating existing components
- Make app timeouts configurable HOT 1
- Select All on 2nd filter in table not showing checked checkboxes
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wave.