Vulnerability in packer project
- Dominant language
- Go
- Stars
- 15.8k
- Forks
- 3.3k
- PR merge metrics
- PR metrics pending
Description
While working on packer project, I scanned the dependency manifest and found that it uses a vulnerable version of **`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`**. The scan revealed a denial-of-service issue where malformed EventStream headers can trigger a panic in the decoder, potentially crashing the application.
[CVE Report](https://vulert.com/vuln-scan/list/fef7e22f-4c11-48a9-9e99-88d13f97e7c5?sort_order=desc&sort_by=created_at)
[CVE Link](https://vulert.com/vuln-db/denial-of-service-due-to-panic-in-aws-sdk-for-go-v2-sdk-eventstream-decoder)
Contributor guide
Research direction
Locate the dependency manifest for the Packer project and inspect the declared github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream dependency. Check the linked CVE details for the affected and fixed versions, update the dependency to a non-vulnerable release, then run the project's relevant Go tests and dependency checks to confirm the vulnerable version is gone.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 58/100