Security Issues with golang.org/x/text and golang.org/x/crypto

[sunny0826]

Just like spf13/viper#1176, older versions of golang.org/x/crypto and golang.org/x/text have security issues reported by CVE with proof of concept attacks.

• CVE-2020-9283 (crypto)
• CVE-2020-14040 (text)

Gemnasium reported these two security issues, which I found in a GItLab Dependencies Security scan.

Details

Loop with Unreachable Exit Condition (Infinite Loop) in golang.org/x/text

Description

The x/text package for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.

Severity: High
Tool: Dependency Scanning
Scanner: Gemnasium

Location

File: go.sum

Links

• https://nvd.nist.gov/vuln/detail/CVE-2020-14040

Identifiers

• Gemnasium-8ab0265a-d1a9-4085-a661-0d9d9931f0ad
• CVE-2020-14040

Solution

Upgrade to version 0.3.3 or above.

Nil Pointer Dereference in golang.org/x/crypto

Description

A nil pointer dereference in the golang.org/x/crypto/ssh component enables remote attackers to cause a DoS against SSH servers.

Severity: High
Tool: Dependency Scanning
Scanner: Gemnasium

Location

File: go.sum

Links

• https://go-review.googlesource.com/c/crypto/+/278852
• https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
• https://nvd.nist.gov/vuln/detail/CVE-2020-29652

Identifiers

• Gemnasium-ffb814a0-404c-11eb-b378-0242ac130002
• CVE-2020-29652

Solution

Upgrade to version v0.0.0-20201216223049-8b5274cf687f or above.

[sunny0826]

Scanned for the cobra project master branch and the latest version 1.3.0

[jpmcb]

These are both low severity for cobra and "indirect" security problems since we are importing viper:

➜ go mod why golang.org/x/crypto
# golang.org/x/crypto
(main module does not need package golang.org/x/crypto)

➜ go mod why golang.org/x/test
# golang.org/x/test
(main module does not need package golang.org/x/test)

Regardless, this should have been addressed in #1567 since viper has bumped it's dependency. We'll cut a winter release shortly and get this out soon.

[github-actions]

This issue is being marked as stale due to a long period of inactivity

[johnSchnake]

So viper dependencies were removed with cobra-cli being extracted, correct? And we've had a new release anyways which the above comment says would have upgraded viper appropriately anyways.

Going to let @jpmcb close this since its a security issue but I think this is completed now.

[jpmcb]

So viper dependencies were removed with cobra-cli being extracted, correct? And we've had a new release anyways which the above comment says would have upgraded viper appropriately anyways.

Correct - this can be closed