influxdata / influxdata/kapacitor

PRISMA-2023-0056 Reported from Twistlock

Open
#2,830 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.4k
Forks
479
Avg merge
4d 16h
Merged PRs (30d)
4

Description

Hi team,

I got the following dependency from Twistlock scan:

**CVE**: PRISMA-2023-0056

**Description**: The github.com/sirupsen/logrus module of all versions is vulnerable to denial of service. Logging more than 64kb of data in a single entry without newlines causes the log writer function to hang indefinitely.

**Vulnerability** link: https://github.com/sirupsen/logrus/issues/1370

```
Image: kapacitor:1.7.5
ID: sha256:35a44c142f039870ab89373fb64c5e1f41c60875ecdffae765e02ca83d6aa6ac
Type: go
Package: github.com/sirupsen/logrus
Package path: /usr/bin/kapacitord
Package version: v1.8.1
Impacted versions:

Contributor guide

Open the contributing guide

Research direction

Start with the dependency entry identified near line 226 of go.mod and compare the current logrus version with the reported impacted versions. Update the dependency as appropriate, then verify that the Kapacitor image no longer contains the vulnerable package version.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.