Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The latest version of terratest is failing a vulnerability scan #1313

Closed
ocofaigh opened this issue Jun 26, 2023 · 1 comment · Fixed by #1314
Closed

The latest version of terratest is failing a vulnerability scan #1313

ocofaigh opened this issue Jun 26, 2023 · 1 comment · Fixed by #1314
Labels
enhancement New feature or request

Comments

@ocofaigh
Copy link

The latest version of terratest is failing a vulnerability scan due to this:

Details:

*Description*: Affected versions of this package are vulnerable to Out-of-bounds Read such that parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.

Manifest:
tests/go.mod

Introduced by:
[google.golang.org/protobuf:1.28.1](http://google.golang.org/protobuf:1.28.1)
[github.com/gruntwork-io/terratest:0.43.4](http://github.com/gruntwork-io/terratest:0.43.4)

*Remediation*: 1.29.1

*URL*: https://security.snyk.io/vuln/SNYK-GOLANG-GOOGLEGOLANGORGPROTOBUF-5673228

Is it possible to release a new version with the later package?

@denis256 denis256 mentioned this issue Jun 26, 2023
4 tasks
@denis256 denis256 added the enhancement New feature or request label Jun 27, 2023
@denis256
Copy link
Member

Fixed in https://github.com/gruntwork-io/terratest/releases/tag/v0.43.5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants