Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update github.com/hashicorp/go-getter/v2 pkgs to address CVE-2023-0475 #162

Merged
merged 1 commit into from
Mar 7, 2023

Conversation

nywilken
Copy link
Contributor

@nywilken nywilken commented Feb 14, 2023

This change bumps the version of github.com/hashicorp/go-getter/v2 and its accompanying submodules to address CVE-2023-0475.

Refer to [HCSEC-2023-4 - go-getter vulnerable to denial of service via malicious compressed archive](https://discuss.hashicorp.com/t/hcsec-2023-4-go-getter-vulnerable-to-denial-of-service-via-malicious-compressed-archive/50125) for more details on the vulnerability being addressed.

@nywilken nywilken requested a review from a team as a code owner February 14, 2023 19:33
@nywilken nywilken added bug Something isn't working security labels Feb 14, 2023
@nywilken nywilken changed the title Update hashicorp/go-getter pkg to address CVE-2023-0475 Update github.com/hashicorp/go-getter/v2 pkgs to address CVE-2023-0475 Feb 14, 2023
Copy link
Contributor

@lbajolet-hashicorp lbajolet-hashicorp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@feiyushi
Copy link

feiyushi commented Mar 6, 2023

@nywilken
Can we get this pr checked in and also upgrade golang.org/x/net to v0.7.0?
We need to address these two vulnerabilities (and in packer-plugin-azure, packer main app):
GHSA-jpxj-2jvg-6jv9
GHSA-vvpx-j8f3-3w6h
thanks!

@nywilken
Copy link
Contributor Author

nywilken commented Mar 6, 2023

@nywilken Can we get this pr checked in and also upgrade golang.org/x/net to v0.7.0? We need to address these two vulnerabilities (and in packer-plugin-azure, packer main app): GHSA-jpxj-2jvg-6jv9 GHSA-vvpx-j8f3-3w6h thanks!

@feiyushi thanks for bubbling this up. I'll work on getting this merged and open a new PR for golang.org/x/net. I held on merging because the Windows tests were failing. I'm running on another system now as I suspect it will pass but Circle needs more time.

@nywilken
Copy link
Contributor Author

nywilken commented Mar 7, 2023

Locally all is green. If it continues to timeout when merged I will open a PR to improve test runner.

PS C:\Development\packer-plugin-sdk> go test ./... 
?       github.com/hashicorp/packer-plugin-sdk/acctest  [no test files]
?       github.com/hashicorp/packer-plugin-sdk/acctest/provisioneracc   [no test files]
?       github.com/hashicorp/packer-plugin-sdk/acctest/testutils        [no test files]
ok      github.com/hashicorp/packer-plugin-sdk/adapter  0.324s
ok      github.com/hashicorp/packer-plugin-sdk/bootcommand      4.992s
ok      github.com/hashicorp/packer-plugin-sdk/chroot   0.367s
?       github.com/hashicorp/packer-plugin-sdk/cmd/packer-sdc   [no test files]
?       github.com/hashicorp/packer-plugin-sdk/cmd/packer-sdc/internal/cmd      [no test files]
ok      github.com/hashicorp/packer-plugin-sdk/cmd/packer-sdc/internal/fs       0.261s
ok      github.com/hashicorp/packer-plugin-sdk/cmd/packer-sdc/internal/mapstructure-to-hcl2     0.351s
?       github.com/hashicorp/packer-plugin-sdk/cmd/packer-sdc/internal/plugincheck      [no test files]
ok      github.com/hashicorp/packer-plugin-sdk/cmd/packer-sdc/internal/renderdocs       0.294s
ok      github.com/hashicorp/packer-plugin-sdk/cmd/packer-sdc/internal/struct-markdown  0.271s
?       github.com/hashicorp/packer-plugin-sdk/cmd/packer-sdc/internal/test-data/packer-plugin-happycloud/builder/happycloud    [no test files]
?       github.com/hashicorp/packer-plugin-sdk/common   [no test files]
ok      github.com/hashicorp/packer-plugin-sdk/communicator     0.365s
ok      github.com/hashicorp/packer-plugin-sdk/communicator/ssh 1.532s
ok      github.com/hashicorp/packer-plugin-sdk/communicator/sshkey      1.526s
?       github.com/hashicorp/packer-plugin-sdk/didyoumean       [no test files]
?       github.com/hashicorp/packer-plugin-sdk/filelock [no test files]
ok      github.com/hashicorp/packer-plugin-sdk/guestexec        0.442s
ok      github.com/hashicorp/packer-plugin-sdk/hcl2helper       0.276s
?       github.com/hashicorp/packer-plugin-sdk/json     [no test files]
ok      github.com/hashicorp/packer-plugin-sdk/multistep        0.325s
ok      github.com/hashicorp/packer-plugin-sdk/multistep/commonsteps    0.664s
ok      github.com/hashicorp/packer-plugin-sdk/net      1.667s
ok      github.com/hashicorp/packer-plugin-sdk/packer   1.215s
ok      github.com/hashicorp/packer-plugin-sdk/packer/registry/image    0.329s
ok      github.com/hashicorp/packer-plugin-sdk/packerbuilderdata        0.296s
ok      github.com/hashicorp/packer-plugin-sdk/pathing  0.494s
ok      github.com/hashicorp/packer-plugin-sdk/plugin   0.517s
?       github.com/hashicorp/packer-plugin-sdk/random   [no test files]
ok      github.com/hashicorp/packer-plugin-sdk/retry    0.360s
ok      github.com/hashicorp/packer-plugin-sdk/rpc      0.501s
ok      github.com/hashicorp/packer-plugin-sdk/sdk-internals/communicator/none  0.230s
ok      github.com/hashicorp/packer-plugin-sdk/sdk-internals/communicator/ssh   0.359s
ok      github.com/hashicorp/packer-plugin-sdk/sdk-internals/communicator/winrm 0.559s
ok      github.com/hashicorp/packer-plugin-sdk/shell    0.262s
ok      github.com/hashicorp/packer-plugin-sdk/shell-local      0.549s
ok      github.com/hashicorp/packer-plugin-sdk/shell-local/localexec    0.520s
ok      github.com/hashicorp/packer-plugin-sdk/shutdowncommand  0.390s
ok      github.com/hashicorp/packer-plugin-sdk/template 0.310s
ok      github.com/hashicorp/packer-plugin-sdk/template/config  0.650s
ok      github.com/hashicorp/packer-plugin-sdk/template/interpolate     0.440s
ok      github.com/hashicorp/packer-plugin-sdk/template/interpolate/aws/secretsmanager  0.470s
?       github.com/hashicorp/packer-plugin-sdk/tmp      [no test files]
ok      github.com/hashicorp/packer-plugin-sdk/useragent        0.411s
ok      github.com/hashicorp/packer-plugin-sdk/uuid     0.215s
?       github.com/hashicorp/packer-plugin-sdk/version  [no test files]

@nywilken nywilken merged commit 2085e33 into main Mar 7, 2023
@nywilken nywilken deleted the update/bump-go-getter-v2.2.0 branch March 7, 2023 16:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants