hashicorp / hashicorp/boundary

Dependency: pgx v5.9.2 missing auth downgrade protection (CWE-306, fix in v5.10.0)

Open Beginner friendly
#6,754 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
4.1k
Forks
317
Avg merge
5h 10m
Merged PRs (30d)
1

Description

Boundary uses jackc/pgx v5.9.2 which lacks require_auth.\n\nFix: v5.10.0+ | Advisory: GHSA-pending | Tool: bounty-hunter vSurface

Contributor guide

Open the contributing guide

Research direction

Locate Boundary's dependency declaration for jackc/pgx v5.9.2 and check the v5.10.0+ release notes for the require_auth fix. Update the dependency to a fixed version, then run the repository's dependency and test checks to verify the vulnerable version is gone and Boundary still passes.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, postgresql
Domain
databases, security
Issue type
Bug
Difficulty
1/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.