Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Readme #2

Closed
liamsi opened this issue Apr 5, 2020 · 0 comments · Fixed by #10
Closed

Update Readme #2

liamsi opened this issue Apr 5, 2020 · 0 comments · Fixed by #10
Assignees
@liamsi
Labels
C:documentation Improvements or additions to documentation

Comments

@liamsi
Copy link
Member

liamsi commented Apr 5, 2020

We should update the Readme with a paragraph that explains that this will become what is essentially "lazyledger-core" (with links to tendermint and lazyledger).

Even if this is currently on par with the original tendermint repo (and only 2 additional unmerged branches) we should do that early to avoid confusion. We'll probably have to do quite some very essential changes to vanilla tendermint anyways.
@liamsi liamsi self-assigned this Apr 8, 2020
@liamsi liamsi added the C:documentation Improvements or additions to documentation label Apr 8, 2020
@liamsi liamsi mentioned this issue Apr 9, 2020
Merged
@liamsi liamsi closed this as completed in #10 Apr 9, 2020
@evan-forbes evan-forbes mentioned this issue Jan 9, 2021
Closed
@sync-by-unito sync-by-unito bot mentioned this issue May 27, 2021
Closed
cmwaters added a commit that referenced this issue Dec 12, 2022
@cmwaters
v2 transaction pool: add pull capability (#2)
b02eb80
cmwaters added a commit that referenced this issue Dec 12, 2022
@cmwaters
v2 transaction pool: add pull capability (#2)
2cae38a
cmwaters added a commit that referenced this issue Jan 2, 2023
@cmwaters
v2 transaction pool: add pull capability (#2)
c39fb34
@hoangdv2429 hoangdv2429 mentioned this issue Dec 11, 2023
Merged
3 tasks
staheri14 added a commit that referenced this issue Jan 23, 2024
@staheri14
chore: update module versions to address issues identified by govulnc…
7673ee0 
…heck (#1186)

This PR addresses the vulnerabilities identified by govulncheck in [PR
#1179](https://github.com/celestiaorg/celestia-core/actions/runs/7629759074/job/20786518441?pr=1179).
It upgrades the affected modules to the versions recommended by
govulncheck.
```
Vulnerability #1: GO-2024-2466
    Denial of service in github.com/go-git/go-git/v5 and
    gopkg.in/src-d/go-git.v4
  More info: https://pkg.go.dev/vuln/GO-2024-2466
  Module: github.com/go-git/go-git/v5
    Found in: github.com/go-git/go-git/[email protected]
    Fixed in: github.com/go-git/go-git/[email protected]
    Example traces found:
Error:       #1: test/e2e/generator/generate.go:402:36: generator.gitRepoLatestReleaseVersion calls git.PlainOpenWithOptions, which calls filesystem.NewStorage
Error:       #2: test/e2e/generator/generate.go:402:36: generator.gitRepoLatestReleaseVersion calls git.PlainOpenWithOptions
Error:       #3: test/e2e/generator/generate.go:407:30: generator.gitRepoLatestReleaseVersion calls git.Repository.TagObjects

Vulnerability #2: GO-2024-2456
    Path traversal and RCE in github.com/go-git/go-git/v5 and
    gopkg.in/src-d/go-git.v4
  More info: https://pkg.go.dev/vuln/GO-2024-2456
  Module: github.com/go-git/go-git/v5
    Found in: github.com/go-git/go-git/[email protected]
    Fixed in: github.com/go-git/go-git/[email protected]
    Example traces found:
Error:       #1: test/e2e/generator/generate.go:402:36: generator.gitRepoLatestReleaseVersion calls git.PlainOpenWithOptions, which calls filesystem.NewStorage
Error:       #2: test/e2e/generator/generate.go:402:36: generator.gitRepoLatestReleaseVersion calls git.PlainOpenWithOptions
Error:       #3: test/e2e/generator/generate.go:407:30: generator.gitRepoLatestReleaseVersion calls git.Repository.TagObjects

=== Informational ===

There are 2 vulnerabilities in modules that you require that are
neither imported nor called. You may not need to take any action.
See https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck for details.

Vulnerability #1: GO-2024-2453
    Timing side channel in github.com/cloudflare/circl
  More info: https://pkg.go.dev/vuln/GO-2024-2453
  Module: github.com/cloudflare/circl
    Found in: github.com/cloudflare/[email protected]
    Fixed in: github.com/cloudflare/[email protected]

Vulnerability #2: GO-2023-[17](https://github.com/celestiaorg/celestia-core/actions/runs/7629759074/job/20786518441?pr=1179#step:5:18)65
    Leaked shared secret and weak blinding in github.com/cloudflare/circl
  More info: https://pkg.go.dev/vuln/GO-[20](https://github.com/celestiaorg/celestia-core/actions/runs/7629759074/job/20786518441?pr=1179#step:5:21)23-1765
  Module: github.com/cloudflare/circl
    Found in: github.com/cloudflare/[email protected]
    Fixed in: github.com/cloudflare/[email protected]

Your code is affected by 2 vulnerabilities from 1 module.

Share feedback at https://go.dev/s/govulncheck-feedback.
exit status 3
make: *** [Makefile:254: vulncheck] Error 1
Error: Process completed with exit code 2.
```
staheri14 added a commit that referenced this issue Mar 11, 2024
@staheri14
chore: updates to go1.22.1 (#1260)
10325da 
In order to fix the go vulnerabilities that are fixed in the new patch:
```
Vulnerability #1: GO-2024-2610
    Errors returned from JSON marshaling may break template escaping in
    html/template
  More info: https://pkg.go.dev/vuln/GO-2024-2610
  Standard library
    Found in: html/[email protected]
    Fixed in: html/[email protected]
    Example traces found:
      #1: test/fuzz/rpc/jsonrpc/server/handler.go:30:15: server.Fuzz calls http.ServeMux.ServeHTTP, which eventually calls template.Template.Execute
      #2: rpc/jsonrpc/server/http_server.go:256:15: server.maxBytesHandler.ServeHTTP calls http.HandlerFunc.ServeHTTP, which eventually calls template.Template.ExecuteTemplate

Vulnerability #2: GO-2024-2600
    Incorrect forwarding of sensitive headers and cookies on HTTP redirect in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2600
  Standard library
    Found in: net/[email protected]
    Fixed in: net/[email protected]
    Example traces found:
      #1: rpc/jsonrpc/client/http_json_client.go:213:34: client.Client.Call calls http.Client.Do
      #2: libs/cli/setup.go:89:26: cli.Executor.Execute calls cobra.Command.Execute, which eventually calls http.Client.Get
      #3: p2p/upnp/upnp.go:205:20: upnp.getServiceURL calls http.Get

Vulnerability #3: GO-2024-2599
    Memory exhaustion in multipart form parsing in net/textproto and net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2599
  Standard library
    Found in: net/[email protected]
    Fixed in: net/[email protected]
    Example traces found:
      #1: rpc/jsonrpc/server/http_server.go:62:16: server.Serve calls http.Server.Serve, which eventually calls textproto.Reader.ReadLine
      #2: rpc/jsonrpc/server/http_server.go:62:16: server.Serve calls http.Server.Serve, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability #4: GO-2024-2598
    Verify panics on certificates with an unknown public key algorithm in
    crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2024-2598
  Standard library
    Found in: crypto/[email protected]
    Fixed in: crypto/[email protected]
    Example traces found:
      #1: libs/autofile/group.go:479:30: autofile.GroupReader.Read calls bufio.Reader.Read, which eventually calls x509.Certificate.Verify

Your code is affected by 4 vulnerabilities from the Go standard library.

```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@liamsi liamsi

Labels
C:documentation Improvements or additions to documentation
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Modify README celestiaorg/celestia-core
1 participant
@liamsi