mirror of
https://github.com/containerd/containerd.git
synced 2026-08-11 09:37:14 +00:00
ff097d5a4c
`govulncheck -mode=binary` detected the following vulns, but `-mode=source` says "your code doesn't appear to call these vulnerabilities." ``` === Symbol Results === Vulnerability #1: GO-2025-3503 HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net More info: https://pkg.go.dev/vuln/GO-2025-3503 Module: golang.org/x/net Found in: golang.org/x/net@v0.33.0 Fixed in: golang.org/x/net@v0.36.0 Vulnerable symbols found: #1: httpproxy.config.useProxy #2: httpproxy.domainMatch.match #3: proxy.Dial #4: proxy.FromEnvironment #5: proxy.FromEnvironmentUsing Use '-show traces' to see the other 3 found symbols Vulnerability #2: GO-2025-3488 Unexpected memory consumption during token parsing in golang.org/x/oauth2 More info: https://pkg.go.dev/vuln/GO-2025-3488 Module: golang.org/x/oauth2 Found in: golang.org/x/oauth2@v0.11.0 Fixed in: golang.org/x/oauth2@v0.27.0 Vulnerable symbols found: #1: jws.Verify Vulnerability #3: GO-2025-3487 Potential denial of service in golang.org/x/crypto More info: https://pkg.go.dev/vuln/GO-2025-3487 Module: golang.org/x/crypto Found in: golang.org/x/crypto@v0.31.0 Fixed in: golang.org/x/crypto@v0.35.0 Vulnerable symbols found: #1: ssh.Client.Dial #2: ssh.Client.DialContext #3: ssh.Client.DialTCP #4: ssh.Client.Listen #5: ssh.Client.ListenTCP Use '-show traces' to see the other 48 found symbols Your code is affected by 3 vulnerabilities from 3 modules. This scan found no other vulnerabilities in packages you import or modules you require. Use '-show verbose' for more details. ``` NOTE: Go version requirement is now bumped up from 1.21 to 1.23 Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>