Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

lokalise2 version 3.0.1 contains CVE-2023-39325 #156

Open
ctrl-f5 opened this issue Aug 7, 2024 · 1 comment
Open

lokalise2 version 3.0.1 contains CVE-2023-39325 #156

ctrl-f5 opened this issue Aug 7, 2024 · 1 comment

Comments

@ctrl-f5
Copy link

ctrl-f5 commented Aug 7, 2024

The binary of lokalise2 contains https://avd.aquasec.com/nvd/2023/cve-2023-39325/

usr/local/bin/lokalise2 (gobinary)
==================================
Total: 1 (HIGH: 1, CRITICAL: 0)
┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2023-39325 │ HIGH     │ fixed  │ v0.15.0           │ 0.17.0        │ golang: net/http, x/net/http2: rapid stream resets can cause │
│                  │                │          │        │                   │               │ excessive work (CVE-2023-44487)                              │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘

as installed on alpine 3.20.2 with the linux install.sh script

@JoppeDC
Copy link

JoppeDC commented Aug 12, 2024

Possibly fixed by merging #143

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants