You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The main branch of core is affected by a go vulnerability, whose log is provided below. Fixing the issue requires using go1.22.5.
The vulnerability message shows up in this PR as well.
Vulnerability #1: GO-2024-2963
Denial of service due to improper 100-continue handling in net/http
More info: https://pkg.go.dev/vuln/GO-2024-2963
Standard library
Found in: net/[email protected]
Fixed in: net/[email protected]
Example traces found:
Error: #1: rpc/jsonrpc/client/http_json_client.go:213:34: client.Client.Call calls http.Client.Do
Error: #2: libs/cli/setup.go:89:26: cli.Executor.Execute calls cobra.Command.Execute, which eventually calls http.Client.Get
Error: #3: p2p/upnp/upnp.go:205:20: upnp.getServiceURL calls http.Get
Error: #4: pkg/trace/fileserver.go:109:28: trace.GetTable calls http.PostForm
Error: #5: pkg/trace/fileserver.go:2[19](https://github.com/celestiaorg/celestia-core/actions/runs/9391599053/job/25864100579#step:5:20):26: trace.PushS3 calls s3.S3.PutObject, which eventually calls http.Transport.CloseIdleConnections
Error: #6: pkg/trace/fileserver.go:[21](https://github.com/celestiaorg/celestia-core/actions/runs/9391599053/job/25864100579#step:5:22)9:26: trace.PushS3 calls s3.S3.PutObject, which eventually calls http.Transport.RoundTrip
Your code is affected by 1 vulnerability from the Go standard library.
This scan also found 1 vulnerability in packages you import and 1 vulnerability
Acceptance Criteria
Bump go version to go1.22.5 in the main branch (and v0.34.x-celestia).
The text was updated successfully, but these errors were encountered:
Problem
The main branch of core is affected by a go vulnerability, whose log is provided below. Fixing the issue requires using go1.22.5.
The vulnerability message shows up in this PR as well.
Acceptance Criteria
The text was updated successfully, but these errors were encountered: