argoproj / argoproj/notifications-engine
Upgrade `goutils` to `v1.1.1` to address Security vulnerability
- Dominant language
- Go
- Stars
- 334
- Forks
- 217
- PR merge metrics
- No merged PRs in 30d
Description
Notifications-engine is currently consuming `v1.1.0` of the `goutils` package
https://nvd.nist.gov/vuln/detail/CVE-2021-4238 has identified a critical vulnerability in this package concerning insecure randomness in the function `CryptoRandomAlphaNumeric` which is consumed by notifications-engine in a code path starting here: https://github.com/argoproj/notifications-engine/blob/master/pkg/templates/service.go#L20
To address this vulnerability the `goutils` package should be bumped up to `v1.1.1`
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the code path identified in pkg/templates/service.go#L20 and inspect the project’s goutils dependency declaration. Confirm the dependency is updated from v1.1.0 to v1.1.1, then verify the existing project checks pass; done means the vulnerable version is no longer consumed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100