argoproj / argoproj/notifications-engine

Upgrade `goutils` to `v1.1.1` to address Security vulnerability

Open
#152 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
334
Forks
217
PR merge metrics
No merged PRs in 30d

Description

Notifications-engine is currently consuming `v1.1.0` of the `goutils` package
https://nvd.nist.gov/vuln/detail/CVE-2021-4238 has identified a critical vulnerability in this package concerning insecure randomness in the function `CryptoRandomAlphaNumeric` which is consumed by notifications-engine in a code path starting here: https://github.com/argoproj/notifications-engine/blob/master/pkg/templates/service.go#L20

To address this vulnerability the `goutils` package should be bumped up to `v1.1.1`

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the code path identified in pkg/templates/service.go#L20 and inspect the project’s goutils dependency declaration. Confirm the dependency is updated from v1.1.0 to v1.1.1, then verify the existing project checks pass; done means the vulnerable version is no longer consumed.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.