influxdata / influxdata/kapacitor
PRISMA-2023-0056 Reported from Twistlock
- Dominant language
- Go
- Stars
- 2.4k
- Forks
- 479
- Avg merge
- 4d 16h
- Merged PRs (30d)
- 4
Description
Hi team,
I got the following dependency from Twistlock scan:
**CVE**: PRISMA-2023-0056
**Description**: The github.com/sirupsen/logrus module of all versions is vulnerable to denial of service. Logging more than 64kb of data in a single entry without newlines causes the log writer function to hang indefinitely.
**Vulnerability** link: https://github.com/sirupsen/logrus/issues/1370
```
Image: kapacitor:1.7.5
ID: sha256:35a44c142f039870ab89373fb64c5e1f41c60875ecdffae765e02ca83d6aa6ac
Type: go
Package: github.com/sirupsen/logrus
Package path: /usr/bin/kapacitord
Package version: v1.8.1
Impacted versions:
Contributor guide
Research direction
Start with the dependency entry identified near line 226 of go.mod and compare the current logrus version with the reported impacted versions. Update the dependency as appropriate, then verify that the Kapacitor image no longer contains the vulnerable package version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100