temporalio / temporalio/features
github.com/uber-go/tally/v4-v4.1.1: 2 vulnerabilities (highest severity is: 7.5)
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 32
- Forks
- 28
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 7
Description
Vulnerable Library - github.com/uber-go/tally/v4-v4.1.1
A Go metrics interface with fast buffered metrics and third party reporters
Library home page: https://proxy.golang.org/github.com/uber-go/tally/v4/@v/v4.1.1.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/github.com/uber-go/tally/v4/@v/v4.1.1.mod
Found in HEAD commit: 08aad3472da56f93f12cc85ec600e9824ae7f41b
Vulnerabilities
| CVE | Severity |  CVSS |
Dependency | Type | Fixed in (github.com/uber-go/tally/v4-v4.1.1 version) | Remediation Possible** |
|---|---|---|---|---|---|---|
| CVE-2019-0210 |  High |
7.5 | github.com/uber-go/tally/v4-v4.1.1 | Direct | 0.13.0 | ✅ |
| CVE-2019-0205 | High |
7.5 | github.com/uber-go/tally/v4-v4.1.1 | Direct | org.apache.thrift:libthrift:0.13.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2019-0210
Vulnerable Library - github.com/uber-go/tally/v4-v4.1.1
A Go metrics interface with fast buffered metrics and third party reporters
Library home page: https://proxy.golang.org/github.com/uber-go/tally/v4/@v/v4.1.1.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/github.com/uber-go/tally/v4/@v/v4.1.1.mod
Dependency Hierarchy:
- ❌ github.com/uber-go/tally/v4-v4.1.1 (Vulnerable Library)
Found in HEAD commit: 08aad3472da56f93f12cc85ec600e9824ae7f41b
Found in base branch: main
Vulnerability Details
In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.
Publish Date: 2019-10-29
URL: CVE-2019-0210
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2019-10-29
Fix Resolution: 0.13.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2019-0205
Vulnerable Library - github.com/uber-go/tally/v4-v4.1.1
A Go metrics interface with fast buffered metrics and third party reporters
Library home page: https://proxy.golang.org/github.com/uber-go/tally/v4/@v/v4.1.1.zip
Path to dependency file: /go.mod
Path to vulnerable library: /go/pkg/mod/cache/download/github.com/uber-go/tally/v4/@v/v4.1.1.mod
Dependency Hierarchy:
- ❌ github.com/uber-go/tally/v4-v4.1.1 (Vulnerable Library)
Found in HEAD commit: 08aad3472da56f93f12cc85ec600e9824ae7f41b
Found in base branch: main
Vulnerability Details
In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.
Publish Date: 2019-10-29
URL: CVE-2019-0205
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0205
Release Date: 2019-10-29
Fix Resolution: org.apache.thrift:libthrift:0.13.0
⛑️ Automatic Remediation will be attempted for this issue.
:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with /go.mod and inspect the direct github.com/uber-go/tally/v4 dependency and its Apache Thrift requirements. Update the vulnerable dependency to a fixed version, then run the repository's available tests and dependency checks. Done means the reported CVE-2019-0210 and CVE-2019-0205 vulnerabilities are no longer present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100