hashicorp / hashicorp/packer

Vulnerability in packer project

Open
#13,603 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Go
Stars
15.8k
Forks
3.3k
PR merge metrics
PR metrics pending

Description

While working on packer project, I scanned the dependency manifest and found that it uses a vulnerable version of **`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`**. The scan revealed a denial-of-service issue where malformed EventStream headers can trigger a panic in the decoder, potentially crashing the application.

[CVE Report](https://vulert.com/vuln-scan/list/fef7e22f-4c11-48a9-9e99-88d13f97e7c5?sort_order=desc&sort_by=created_at)
[CVE Link](https://vulert.com/vuln-db/denial-of-service-due-to-panic-in-aws-sdk-for-go-v2-sdk-eventstream-decoder)

Contributor guide

Open the contributing guide

Research direction

Locate the dependency manifest for the Packer project and inspect the declared github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream dependency. Check the linked CVE details for the affected and fixed versions, update the dependency to a non-vulnerable release, then run the project's relevant Go tests and dependency checks to confirm the vulnerable version is gone.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.