From b8e51bc24cad44700f251137aee19d4c89a35ac5 Mon Sep 17 00:00:00 2001 From: Ashley Davis Date: Mon, 7 Nov 2022 12:16:41 +0000 Subject: [PATCH] fix x/text vuln and ignore AWS vuln Signed-off-by: Ashley Davis --- .trivyignore | 7 +++++++ LICENSES | 2 +- go.mod | 2 +- go.sum | 2 ++ 4 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000..72622a3c7 --- /dev/null +++ b/.trivyignore @@ -0,0 +1,7 @@ +# These vulns relate to issues with v1 of the AWS Golang SDK +# These issues relate to S3 encryption issues which cert-manager is unlikely to hit +# Fixing them requires upgrading to v2 of the AWS Golang SDK which is a potentially large task +CVE-2020-8911 +CVE-2020-8912 +GHSA-7f33-f4f5-xwgw +GHSA-f5pg-7wfw-84q9 diff --git a/LICENSES b/LICENSES index a18c0732a..f36a1d9bd 100644 --- a/LICENSES +++ b/LICENSES @@ -200,7 +200,7 @@ golang.org/x/oauth2,https://cs.opensource.google/go/x/oauth2/+/f2134210:LICENSE, golang.org/x/sync,https://cs.opensource.google/go/x/sync/+/7f9b1623:LICENSE,BSD-3-Clause golang.org/x/sys,https://cs.opensource.google/go/x/sys/+/3c1f3524:LICENSE,BSD-3-Clause golang.org/x/term,https://cs.opensource.google/go/x/term/+/03fcf44c:LICENSE,BSD-3-Clause -golang.org/x/text,https://cs.opensource.google/go/x/text/+/v0.3.7:LICENSE,BSD-3-Clause +golang.org/x/text,https://cs.opensource.google/go/x/text/+/v0.3.8:LICENSE,BSD-3-Clause golang.org/x/time/rate,https://cs.opensource.google/go/x/time/+/579cf78f:LICENSE,BSD-3-Clause gomodules.xyz/jsonpatch/v2,https://github.com/gomodules/jsonpatch/blob/v2.2.0/v2/LICENSE,Apache-2.0 google.golang.org/api,https://github.com/googleapis/google-api-go-client/blob/v0.97.0/LICENSE,BSD-3-Clause diff --git a/go.mod b/go.mod index 31aa64600..575461f99 100644 --- a/go.mod +++ b/go.mod @@ -231,7 +231,7 @@ require ( golang.org/x/net v0.0.0-20220921155015-db77216a4ee9 // indirect golang.org/x/sys v0.0.0-20220728004956-3c1f35247d10 // indirect golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect - golang.org/x/text v0.3.7 // indirect + golang.org/x/text v0.3.8 // indirect golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect golang.org/x/tools v0.1.12 // indirect google.golang.org/appengine v1.6.7 // indirect diff --git a/go.sum b/go.sum index c5549acfc..cd784ff9d 100644 --- a/go.sum +++ b/go.sum @@ -1305,6 +1305,8 @@ golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +golang.org/x/text v0.3.8 h1:nAL+RVCQ9uMn3vJZbV+MRnydTJFPf8qqY42YiA6MrqY= +golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ= golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=