Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Go and logrus for vulns. #138

Merged
merged 3 commits into from
Oct 18, 2023
Merged

Update Go and logrus for vulns. #138

merged 3 commits into from
Oct 18, 2023

Conversation

jl-coogan
Copy link
Contributor

@jl-coogan jl-coogan commented Oct 11, 2023 •
edited
Loading

Purpose of this PR

  1. Address 5 vulnerabilities by updating go from 1.20.5 to 1.21.3.
  2. Address 1 vulnerability by updating logrus from 1.6.0 to 1.9.3.
  3. Add a convenience govulncheck to GitHub Actions and to Makefile.

go vulnerabilities addressed

CVE CVSS Severity Package Version Fixed in version
CVE-2023-39533 7.5 high go 1.20.5 1.20.7, 1.19.12
CVE-2023-29406 6.5 medium go 1.20.5 1.20.6, 1.19.11
CVE-2023-39319 6.1 medium go 1.20.5 1.21.1, 1.20.8
CVE-2023-39318 6.1 medium go 1.20.5 1.21.1, 1.20.8
CVE-2023-29409 5.3 medium go 1.20.5 1.20.7, 1.19.12

logrus vulnerabilities addressed

CVE CVSS Severity Package Version Fixed in version
PRISMA-2023-0056 6.2 medium github.com/sirupsen/logrus v1.6.0 v1.9.3

@jl-coogan
Copy link
Contributor Author

@UserNotFound, I have looked at the previous PR which @almathew approved and you merged for vuln-related updates and am kindly submitting another one, for a series of new vulnerabilities to keep supercronic binary free of CVEs.

This is my first PR into this project, so please let me know if you want me to change anything in order to get this through.

Thank you.

@BenBrugman BenBrugman mentioned this pull request Oct 16, 2023
Closed
UserNotFound
UserNotFound approved these changes Oct 18, 2023
View reviewed changes
Copy link
Member

@UserNotFound UserNotFound left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for adding govulncheck!

@UserNotFound UserNotFound merged commit ae07d22 into aptible:master Oct 18, 2023
1 check passed
arthurgeek referenced this pull request in arthurgeek/vaultwarden-fly-template Oct 28, 2023
@renovate
fix(github-release): update aptible/supercronic to v0.2.27 (#23)
8193d05 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [aptible/supercronic](https://togithub.com/aptible/supercronic) |
patch | `v0.2.26` -> `v0.2.27` |

---

### Release Notes

<details>
<summary>aptible/supercronic (aptible/supercronic)</summary>

###
[`v0.2.27`](https://togithub.com/aptible/supercronic/releases/tag/v0.2.27)

[Compare
Source](https://togithub.com/aptible/supercronic/compare/v0.2.26...v0.2.27)

#### What's Changed

- Update README.md by
[@&#8203;rihardsgrislis](https://togithub.com/rihardsgrislis) in
[https://github.com/aptible/supercronic/pull/135](https://togithub.com/aptible/supercronic/pull/135)
- Update Go and logrus for vulns. by
[@&#8203;jl-coogan](https://togithub.com/jl-coogan) in
[https://github.com/aptible/supercronic/pull/138](https://togithub.com/aptible/supercronic/pull/138)

#### New Contributors

- [@&#8203;rihardsgrislis](https://togithub.com/rihardsgrislis) made
their first contribution in
[https://github.com/aptible/supercronic/pull/135](https://togithub.com/aptible/supercronic/pull/135)
- [@&#8203;jl-coogan](https://togithub.com/jl-coogan) made their first
contribution in
[https://github.com/aptible/supercronic/pull/138](https://togithub.com/aptible/supercronic/pull/138)

**Full Changelog**:
aptible/supercronic@v0.2.26...v0.2.27

### Installation Instructions

#### supercronic-linux-amd64

Add the following stanza to your Dockerfile to install
`supercronic-linux-amd64`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.27/supercronic-linux-amd64
\
        SUPERCRONIC=supercronic-linux-amd64 \
        SUPERCRONIC_SHA1SUM=7dadd4ac827e7bd60b386414dfefc898ae5b6c63

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-386

Add the following stanza to your Dockerfile to install
`supercronic-linux-386`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.27/supercronic-linux-386
\
        SUPERCRONIC=supercronic-linux-386 \
        SUPERCRONIC_SHA1SUM=3f4becf1d5f2380e9635a6a8b79894e8e2f43455

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-arm

Add the following stanza to your Dockerfile to install
`supercronic-linux-arm`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.27/supercronic-linux-arm
\
        SUPERCRONIC=supercronic-linux-arm \
        SUPERCRONIC_SHA1SUM=6b04fe278b364d0b35b066250a129cb44c04b990

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-arm64

Add the following stanza to your Dockerfile to install
`supercronic-linux-arm64`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.27/supercronic-linux-arm64
\
        SUPERCRONIC=supercronic-linux-arm64 \
        SUPERCRONIC_SHA1SUM=ec114784804d76b562a473ebe8ed972383f960e2

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "on saturday" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/arthurgeek/vaultwarden-fly-template).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xOS4yIiwidXBkYXRlZEluVmVyIjoiMzcuMTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
arthurgeek referenced this pull request in arthurgeek/vaultwarden-fly Nov 2, 2023
@renovate
fix(github-release): update aptible/supercronic to v0.2.27 (#15)
297f170 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [aptible/supercronic](https://togithub.com/aptible/supercronic) |
patch | `v0.2.26` -> `v0.2.27` |

---

### Release Notes

<details>
<summary>aptible/supercronic (aptible/supercronic)</summary>

###
[`v0.2.27`](https://togithub.com/aptible/supercronic/releases/tag/v0.2.27)

[Compare
Source](https://togithub.com/aptible/supercronic/compare/v0.2.26...v0.2.27)

#### What's Changed

- Update README.md by
[@&#8203;rihardsgrislis](https://togithub.com/rihardsgrislis) in
[https://github.com/aptible/supercronic/pull/135](https://togithub.com/aptible/supercronic/pull/135)
- Update Go and logrus for vulns. by
[@&#8203;jl-coogan](https://togithub.com/jl-coogan) in
[https://github.com/aptible/supercronic/pull/138](https://togithub.com/aptible/supercronic/pull/138)

#### New Contributors

- [@&#8203;rihardsgrislis](https://togithub.com/rihardsgrislis) made
their first contribution in
[https://github.com/aptible/supercronic/pull/135](https://togithub.com/aptible/supercronic/pull/135)
- [@&#8203;jl-coogan](https://togithub.com/jl-coogan) made their first
contribution in
[https://github.com/aptible/supercronic/pull/138](https://togithub.com/aptible/supercronic/pull/138)

**Full Changelog**:
aptible/supercronic@v0.2.26...v0.2.27

### Installation Instructions

#### supercronic-linux-amd64

Add the following stanza to your Dockerfile to install
`supercronic-linux-amd64`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.27/supercronic-linux-amd64
\
        SUPERCRONIC=supercronic-linux-amd64 \
        SUPERCRONIC_SHA1SUM=7dadd4ac827e7bd60b386414dfefc898ae5b6c63

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-386

Add the following stanza to your Dockerfile to install
`supercronic-linux-386`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.27/supercronic-linux-386
\
        SUPERCRONIC=supercronic-linux-386 \
        SUPERCRONIC_SHA1SUM=3f4becf1d5f2380e9635a6a8b79894e8e2f43455

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-arm

Add the following stanza to your Dockerfile to install
`supercronic-linux-arm`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.27/supercronic-linux-arm
\
        SUPERCRONIC=supercronic-linux-arm \
        SUPERCRONIC_SHA1SUM=6b04fe278b364d0b35b066250a129cb44c04b990

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

#### supercronic-linux-arm64

Add the following stanza to your Dockerfile to install
`supercronic-linux-arm64`.

You will need to install `curl` beforehand.

### Latest releases available at
https://github.com/aptible/supercronic/releases
ENV
SUPERCRONIC_URL=https://github.com/aptible/supercronic/releases/download/v0.2.27/supercronic-linux-arm64
\
        SUPERCRONIC=supercronic-linux-arm64 \
        SUPERCRONIC_SHA1SUM=ec114784804d76b562a473ebe8ed972383f960e2

    RUN curl -fsSLO "$SUPERCRONIC_URL" \
     && echo "${SUPERCRONIC_SHA1SUM}  ${SUPERCRONIC}" | sha1sum -c - \
     && chmod +x "$SUPERCRONIC" \
     && mv "$SUPERCRONIC" "/usr/local/bin/${SUPERCRONIC}" \
     && ln -s "/usr/local/bin/${SUPERCRONIC}" /usr/local/bin/supercronic

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "on saturday" (UTC), Automerge - At
any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/arthurgeek/vaultwarden-fly).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4xOS4yIiwidXBkYXRlZEluVmVyIjoiMzcuMTkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ddl-jrakos ddl-jrakos ddl-jrakos approved these changes

@UserNotFound UserNotFound UserNotFound approved these changes

@krallin krallin Awaiting requested review from krallin krallin is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@jl-coogan @UserNotFound @ddl-jrakos