Found CVE-2020-14040 in current package
Open
- Dominant language
- Go
- Stars
- 6.8k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
gopacket is using an old version of x/net lib:
`golang.org/x/net v0.0.0-20190620200207-3b0461eec859`
which in turn uses the following libraries(saw dependencies using "go mod graph" command):
`golang.org/x/net@v0.0.0-20190620200207-3b0461eec859 golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2
golang.org/x/net@v0.0.0-20190620200207-3b0461eec859 golang.org/x/sys@v0.0.0-20190215142949-d0b11bdaac8a
golang.org/x/net@v0.0.0-20190620200207-3b0461eec859 golang.org/x/text@v0.3.0`
Out of those: "golang.org/x/text@v0.3.0" has [CVE-2020-14040](https://nvd.nist.gov/vuln/detail/CVE-2020-14040) vulnerability
Contributor guide
Assessment
This issue has not been assessed yet.