appleboy / appleboy/lambda-action

Vulnerabilities in golang/crypto < 0.35.0 and golang/net < 0.38.0

Open
#87 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
D2
Stars
435
Forks
57
PR merge metrics
No merged PRs in 30d

Description

Two of the golang packages used in this action contains vulnerabilities. Would really appreciate if these could be patched soon 🙏

```yml
uses: appleboy/lambda-action@v0.2.0
```

Critical severity vulnerabilities .. 🔥

| Vulnerability | Package |
-- | --
| [GHSA-v778-237x-gjrc](https://github.com/advisories/GHSA-v778-237x-gjrc) | pkg:golang/golang.org/x/crypto@v0.22.0 |

High severity vulnerabilities .. ⚠️

| Vulnerability | Package |
-- | --
| [GHSA-hcg3-q754-cr77](https://github.com/advisories/GHSA-hcg3-q754-cr77) | pkg:golang/golang.org/x/crypto@v0.22.0 |

Medium severity vulnerabilities ..

| Vulnerability | Package |
-- | --
| [GHSA-qxp5-gwg8-xv66](https://github.com/advisories/GHSA-qxp5-gwg8-xv66) | pkg:golang/golang.org/x/net@v0.24.0 |
| [GHSA-vvgc-356p-c3xw](https://github.com/advisories/GHSA-vvgc-356p-c3xw) | pkg:golang/golang.org/x/net@v0.24.0

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the Go dependency declarations for golang.org/x/crypto and golang.org/x/net, then compare their versions with the minimum versions stated in the issue. Update the dependencies and verify that the action still builds and that the listed advisories are no longer present.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, go
Domain
ci-cd, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.