Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade github.com/snowflakedb/gosnowflake to the newer version #569

Open
xdingsplk opened this issue May 20, 2021 · 9 comments
Open

Upgrade github.com/snowflakedb/gosnowflake to the newer version #569

xdingsplk opened this issue May 20, 2021 · 9 comments

Comments

@xdingsplk
Copy link

xdingsplk commented May 20, 2021 •
edited
Loading

Describe the Bug
github.com/snowflakedb/gosnowflake@v1.3.5 has a dependency on github.com/dgrijalva/jwt-go@v3.2.0+incompatible
this version of jwt-go has a vulnerability of:

  • allowing attackers to bypass intended access restrictions in situations with []string{} for m["aud"]
    And this will cause a security issue, newer version of gosnowflake remove this dependency
@dhui
Copy link
Member

dhui commented May 21, 2021

Thanks for the report. It looks like this is the vulnerability you were referring to

@dhui dhui closed this as completed in 8a1a853 May 22, 2021
@xdingsplk
Copy link
Author

Thanks for the commit to fix it

@xdingsplk
Copy link
Author

xdingsplk commented Jun 9, 2021 •
edited
Loading

Just a follow up on this. I realized that gosnowflakeDB still has a dependency to this vulnerable jwt-go. They remove the direct dependency but later on they added another dependency which brings it back..

github.com/golang-migrate/migrate/v4@v4.14.2-0.20210521165626-8a1a8534dc64

github.com/snowflakedb/gosnowflake@v1.4.3

github.com/snowflakedb/gosnowflake@v1.4.3 github.com/Azure/azure-storage-blob-go@v0.13.0

github.com/Azure/azure-storage-blob-go@v0.13.0 github.com/Azure/go-autorest/autorest/adal@v0.9.2

github.com/Azure/go-autorest/autorest/adal@v0.9.2 github.com/dgrijalva/jwt-go@v3.2.0+incompatible

@dhui
Copy link
Member

dhui commented Jun 9, 2021

Haha! 🤦

Thanks for re-reporting! I've reopened the issue and will keep it open until the upstream dependencies are fixed.
Looks like this is still and issue in v1.5.0

@dhui dhui reopened this Jun 9, 2021
@xdingsplk
Copy link
Author

just FYI, my team decided to use "replace" to get rid of the vulnerable code in jwt-go. It was too much for us to track the dependencies all the way down to 4 repos. But we can keep the issue open to track this vulnerability.

@kchodnicki
Copy link

The issue still exists:

github.com/dhui/dktest@v0.3.7
- github.com/containerd/containerd@v1.5.7
-- github.com/Microsoft/hcsshim@v0.8.21
--- github.com/containerd/containerd@v1.5.1 (yeah...)
---- k8s.io/component-base@v0.20.6 (also 0.20.1 and 0.20.4)
----- k8s.io/client-go@v0.20.6
------ github.com/Azure/go-autorest/autorest@v0.11.1
------- github.com/Azure/go-autorest/autorest/adal@v0.9.0
-------- github.com/dgrijalva/jwt-go@v3.2.0+incompatible

I know it's only used for testing, but still...
CVE details: https://nvd.nist.gov/vuln/detail/CVE-2020-26160

@zibi94
Copy link

zibi94 commented Nov 5, 2021

And more issues:

The issue still exists:

github.com/dhui/dktest@v0.3.7
- github.com/containerd/containerd@v1.5.7
-- github.com/Microsoft/hcsshim@v0.8.21
--- github.com/containerd/containerd@v1.5.1 (yeah...)
---- k8s.io/component-base@v0.20.6 (also 0.20.1 and 0.20.4)
----- k8s.io/client-go@v0.20.6
------ github.com/Azure/go-autorest/autorest@v0.11.1
------- github.com/Azure/go-autorest/autorest/adal@v0.9.0
-------- github.com/dgrijalva/jwt-go@v3.2.0+incompatible

I know it's only used for testing, but still... CVE details: https://nvd.nist.gov/vuln/detail/CVE-2020-26160

And more issues:

[CVE-2020-8558] The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, ...
[CVE-2019-11248] The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet ...
[CVE-2019-11247] The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custo...
[CVE-2019-11243] Credentials Management
[CVE-2021-25741] A security issue was discovered in Kubernetes where a user may be able to create...
[CVE-2020-8552] The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, ...
[CVE-2019-11253] Improper input validation in the Kubernetes API server in versions v1.0-1.12 and...

-> github.com/golang-migrate/migrate/v4@v4.15.1

--> github.com/dhui/dktest@v0.3.7

---> github.com/containerd/containerd@v1.5.7

----> github.com/containerd/aufs@v1.0.0

-----> github.com/containerd/containerd@v1.5.0-beta.3

------> github.com/Microsoft/hcsshim@v0.8.15

-------> github.com/containerd/containerd@v1.5.0-beta.1

--------> github.com/containerd/aufs@v0.0.0-20200908144142-dab0cbea06f4

----------> github.com/Microsoft/hcsshim@v0.8.7

----------->k8s.io/kubernetes@v1.13.0

[CVE-2020-15114] In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP prox...

-> github.com/golang-migrate/migrate/v4@v4.15.1

--> github.com/dhui/dktest@v0.3.7

---> github.com/containerd/containerd@v1.5.7

----> github.com/containerd/continuity@v0.1.0

-----> github.com/spf13/cobra@v1.0.0

------> github.com/spf13/viper@v1.4.0

-------> github.com/coreos/etcd@v3.3.10+incompatible

@BenjaminPelletier BenjaminPelletier mentioned this issue Jan 4, 2022
Merged
@zibi94
Copy link

zibi94 commented May 25, 2022 •
edited
Loading

Nancy again found Vulnerabilities:
[CVE-2022-24778] CWE-863: Incorrect Authorization

--> github.com/golang-migrate/migrate/v4@v4.15.2
----> github.com/dhui/dktest@v0.3.10
------> github.com/containerd/containerd@v1.6.1
-------- github.com/containerd/imgcrypt@v1.1.3

sonatype-2021-0853

--> github.com/golang-migrate/migrate/v4@v4.15.2
----> github.com/jackc/pgproto3/v2@v2.0.7

[CVE-2022-29162] CWE-276: Incorrect Default Permissions

--> github.com/golang-migrate/migrate/v4@v4.15.2
----> github.com/dhui/dktest@v0.3.10
------> github.com/containerd/containerd@v1.6.1
--------> github.com/opencontainers/runc@v1.1.0

[CVE-2022-21698] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

--> github.com/golang-migrate/migrate/v4@v4.15.2
----> github.com/dhui/dktest@v0.3.10
------> github.com/containerd/containerd@v1.6.1
---------> github.com/prometheus/client_golang@v1.11.0

[CVE-2020-8558] CWE-287: Improper Authentication
[CVE-2019-11248] CWE-862: Missing Authorization
[CVE-2019-11243] CWE-212: Improper Cross-boundary Removal of Sensitive Data
[CVE-2019-11247] CWE-863: Incorrect Authorization
[CVE-2021-25741] CWE-552: Files or Directories Accessible to External Parties
[CVE-2019-11253] CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
[CVE-2020-8559] CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
[CVE-2019-1002100] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
[CVE-2019-11249] CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
[CVE-2019-11250] CWE-532: Information Exposure Through Log Files
[CVE-2019-11252] CWE-209: Information Exposure Through an Error Message
[CVE-2019-11254] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
[CVE-2020-8551] CWE-770: Allocation of Resources Without Limits or Throttling
[CVE-2021-25735] CWE-863: Incorrect Authorization
[CVE-2019-11251] CWE-59: Improper Link Resolution Before File Access ('Link Following')
[CVE-2020-8566] CWE-532: Information Exposure Through Log Files
[CVE-2020-8557] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
[CVE-2020-8564] CWE-532: Information Exposure Through Log Files
[CVE-2020-8565] CWE-532: Information Exposure Through Log Files
[CVE-2019-1002101] CWE-59: Improper Link Resolution Before File Access ('Link Following')
[CVE-2019-11244] CWE-732: Incorrect Permission Assignment for Critical Resource
[CVE-2020-8554] CWE-863: Incorrect Authorization
[CVE-2021-3636] CWE-287: Improper Authentication
[CVE-2021-25736] CWE-20: Improper Input Validation
[CVE-2020-8552] CWE-770: Allocation of Resources Without Limits or Throttling
[CVE-2020-8561] CWE-610: Externally Controlled Reference to a Resource in Another Sphere
[CVE-2020-8562] CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
[CVE-2021-25740] CWE-610: Externally Controlled Reference to a Resource in Another Sphere
[CVE-2021-25743] CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
[CVE-2018-1002102] CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

--> github.com/golang-migrate/migrate/v4@v4.15.2
----> github.com/dhui/dktest@v0.3.10
------> github.com/containerd/containerd@v1.6.1
--------> github.com/Microsoft/hcsshim@v0.8.7
-----------> k8s.io/kubernetes@v1.13.0

sonatype-2019-0702

--> github.com/golang-migrate/migrate/v4@v4.15.2
----> go.mongodb.org/mongo-driver@v1.7.0
------> github.com/gobuffalo/packr/v2@v2.2.0

@serhatperkmen
Copy link

Hello folks,

Any update about the vulnerabilities?

FPiety0521 pushed a commit to FPiety0521/Golang-SQL that referenced this issue May 24, 2023
Update snowflake DB driver to update to non-vulnerable jwt downstream…
1726d67 
… package

Fixes golang-migrate/migrate#569
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@dhui @kchodnicki @serhatperkmen @zibi94 @xdingsplk