hashicorp / hashicorp/boundary
Dependency: pgx v5.9.2 missing auth downgrade protection (CWE-306, fix in v5.10.0)
Open
Beginner friendly
- Dominant language
- Go
- Stars
- 4.1k
- Forks
- 317
- Avg merge
- 5h 10m
- Merged PRs (30d)
- 1
Description
Boundary uses jackc/pgx v5.9.2 which lacks require_auth.\n\nFix: v5.10.0+ | Advisory: GHSA-pending | Tool: bounty-hunter vSurface
Contributor guide
Research direction
Locate Boundary's dependency declaration for jackc/pgx v5.9.2 and check the v5.10.0+ release notes for the require_auth fix. Update the dependency to a fixed version, then run the repository's dependency and test checks to verify the vulnerable version is gone and Boundary still passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, postgresql
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 72/100