CVE reported for golang protobuf, crypto, and net (CVE-2024-24786, CVE-2024-45337, CVE-2023-45288, CVE-2024-45338) #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Closed

kernelcore8 opened this issue Mar 4, 2025 · 1 comment

kernelcore8 commented Mar 4, 2025 •

edited

Loading

Multiple CVE have been reported for these dependencies:

CVE-2024-24786 (medium) : golang protobuf (1.32.0) (fixed in 1.33.0) (see PR Bump google.golang.org/protobuf from 1.32.0 to 1.33.0 #82)
CVE-2024-45337 (high) : golang/x/crypto (0.19.0) (fixed in 0.31.0) (see PR Bump golang.org/x/crypto from 0.17.0 to 0.31.0 #80)
CVE-2023-45288 (medium) : golang/x/net (0.20.0) (fixed in 0.23.0)
CVE-2024-45338 (medium) : golang/x/net (0.20.0) (fixed in 0.23.0)

Affected version: code-marketplace 2.3.0

code-marketplace/go.mod

Line 44 in f8791bb

google.golang.org/protobuf v1.32.0 // indirect
code-marketplace/go.mod

Line 36 in f8791bb

golang.org/x/crypto v0.19.0 // indirect
code-marketplace/go.mod

Line 37 in f8791bb

golang.org/x/net v0.20.0 // indirect

Is it possible to update these dependencies and build a new version of code-marketplace?

Member

code-asher commented Mar 6, 2025

Thanks for the heads up, I will get these merged and a new release today.

code-asher closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment