Snyk test report
- docker.io/mongo:8.0/mongo (deb)
- docker.io/mongo:8.0//usr/bin/bsondump (gomodules)
- docker.io/mongo:8.0//usr/bin/mongodump (gomodules)
- docker.io/mongo:8.0//usr/bin/mongoexport (gomodules)
- docker.io/mongo:8.0//usr/bin/mongofiles (gomodules)
- docker.io/mongo:8.0//usr/bin/mongoimport (gomodules)
- docker.io/mongo:8.0//usr/bin/mongorestore (gomodules)
- docker.io/mongo:8.0//usr/bin/mongostat (gomodules)
- docker.io/mongo:8.0//usr/bin/mongotop (gomodules)
- docker.io/mongo:8.0/tianon/gosu//usr/local/bin/gosu (gomodules)
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/archive/zip is a Go standard library package std/archive/zip
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.
Remediation
Upgrade std/archive/zip to version 1.24.12, 1.25.6 or higher.
References
Resources Downloaded over Insecure Protocol
Detailed paths
Overview
Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol.
Go Vulnerability Report:
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module proxy (GOMODPROXY) or checksum database (GOSUMDB). A malicious module proxy can serve altered versions of the Go toolchain. When selecting a different version of the Go toolchain than the currently installed toolchain (due to the GOTOOLCHAIN environment variable, or a go.work or go.mod with a toolchain line), the go command will download and execute a toolchain provided by the module proxy. A malicious module proxy can bypass checksum database validation for this downloaded toolchain. Since this vulnerability affects the security of toolchain downloads, setting GOTOOLCHAIN to a fixed version is not sufficient. You must upgrade your base Go toolchain. The go tool always validates the hash of a toolchain before executing it, so fixed versions will refuse to execute any cached, altered versions of the toolchain. The go tool trusts go.sum files to contain accurate hashes of the current module's dependencies. A malicious proxy exploiting this vulnerability to serve an altered module will have caused an incorrect hash to be recorded in the go.sum. Users who have configured a non-trusted GOPROXY can determine if they have been affected by running "rm go.sum ; go mod tidy ; go mod verify", which will revalidate all dependencies of the current module. The specific flaw in more detail: The go command consults the checksum database to validate downloaded modules, when a module is not listed in the go.sum file. It verifies that the module hash reported by the checksum database matches the hash of the downloaded module. If, however, the checksum database returns a successful response that contains no entry for the module, the go command incorrectly permitted validation to succeed. A module proxy may mirror or proxy the checksum database, in which case the go command will not connect to the checksum database directly. Checksums reported by the checksum database are cryptographically signed, so a malicious proxy cannot alter the reported checksum for a module. However, a proxy which returns an empty checksum response, or a checksum response for an unrelated module, could cause the go command to proceed as if a downloaded module has been validated.
Remediation
Upgrade std/cmd/go to version 1.25.10, 1.26.3 or higher.
References
Directory Traversal
Detailed paths
Overview
Affected versions of this package are vulnerable to Directory Traversal.
Go Vulnerability Report:
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" subcommand can write files to arbitrary locations on the filesystem.
Details
A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.
Directory Traversal vulnerabilities can be generally divided into two types:
- Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.
st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.
If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.
curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa
Note %2e is the URL encoded version of . (dot).
- Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as
Zip-Slip.
One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.
The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:
2018-04-15 22:04:29 ..... 19 19 good.txt
2018-04-15 22:04:42 ..... 20 20 ../../../../../../root/.ssh/authorized_keys
Remediation
Upgrade std/cmd/go to version 1.25.10, 1.26.3 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/crypto/tls is a Go standard library package std/crypto/tls
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
Remediation
Upgrade std/crypto/tls to version 1.25.9, 1.26.2 or higher.
References
Denial of Service (DoS)
Detailed paths
Overview
std/crypto/tls is a Go standard library package std/crypto/tls
Affected versions of this package are vulnerable to Denial of Service (DoS).
Go Vulnerability Report:
Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.
Details
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
Two common types of DoS vulnerabilities:
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm
wspackage
Remediation
Upgrade std/crypto/tls to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.
References
Uncaught Exception
Detailed paths
Overview
std/crypto/x509 is a Go standard library package std/crypto/x509
Affected versions of this package are vulnerable to Uncaught Exception.
Go Vulnerability Report:
Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.This affects programs which validate arbitrary certificate chains.
Remediation
Upgrade std/crypto/x509 to version 1.24.8, 1.25.2 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/crypto/x509 is a Go standard library package std/crypto/x509
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.This affects programs which validate arbitrary certificate chains.
Remediation
Upgrade std/crypto/x509 to version 1.24.9, 1.25.3 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/crypto/x509 is a Go standard library package std/crypto/x509
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Remediation
Upgrade std/crypto/x509 to version 1.25.9, 1.26.2 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/crypto/x509 is a Go standard library package std/crypto/x509
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Remediation
Upgrade std/crypto/x509 to version 1.25.11, 1.26.4 or higher.
References
Uncontrolled Recursion
Detailed paths
Overview
std/encoding/asn1 is a Go standard library package std/encoding/asn1
Affected versions of this package are vulnerable to Uncontrolled Recursion.
Go Vulnerability Report:
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
Remediation
Upgrade std/encoding/asn1 to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/encoding/pem is a Go standard library package std/encoding/pem
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.This affects programs which parse untrusted PEM inputs.
Remediation
Upgrade std/encoding/pem to version 1.24.8, 1.25.2 or higher.
References
Uncontrolled Recursion
Detailed paths
Overview
std/encoding/xml is a Go standard library package std/encoding/xml
Affected versions of this package are vulnerable to Uncontrolled Recursion.
Go Vulnerability Report:
Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.
Remediation
Upgrade std/encoding/xml to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.
References
Time-of-check Time-of-use (TOCTOU) Race Condition
Detailed paths
Overview
std/internal/syscall/unix is a Go standard library package std/internal/syscall/unix
Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition.
Go Vulnerability Report:
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
Remediation
Upgrade std/internal/syscall/unix to version 1.25.9, 1.26.2 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/mime is a Go standard library package std/mime
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Remediation
Upgrade std/mime to version 1.25.11, 1.26.4 or higher.
References
Double Free
Detailed paths
Overview
std/net is a Go standard library package std/net
Affected versions of this package are vulnerable to Double Free.
Go Vulnerability Report:
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
Remediation
Upgrade std/net to version 1.25.10, 1.26.3 or higher.
References
Uncaught Exception
Detailed paths
Overview
std/net is a Go standard library package std/net
Affected versions of this package are vulnerable to Uncaught Exception.
Go Vulnerability Report:
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
Remediation
Upgrade std/net to version 1.25.10, 1.26.3 or higher.
References
Infinite loop
Detailed paths
Overview
std/net/http is a Go standard library package std/net/http
Affected versions of this package are vulnerable to Infinite loop.
Go Vulnerability Report:
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Remediation
Upgrade std/net/http to version 1.25.10, 1.26.3 or higher.
References
Denial of Service (DoS)
Detailed paths
Overview
std/net/http is a Go standard library package std/net/http
Affected versions of this package are vulnerable to Denial of Service (DoS).
Go Vulnerability Report:
When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.
Details
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
Two common types of DoS vulnerabilities:
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm
wspackage
Remediation
Upgrade std/net/http to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/net/mail is a Go standard library package std/net/mail
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption.
Remediation
Upgrade std/net/mail to version 1.24.8, 1.25.2 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/net/mail is a Go standard library package std/net/mail
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
Remediation
Upgrade std/net/mail to version 1.25.10, 1.26.3 or higher.
References
Allocation of Resources Without Limits or Throttling
Detailed paths
Overview
std/net/url is a Go standard library package std/net/url
Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling.
Go Vulnerability Report:
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.
Remediation
Upgrade std/net/url to version 1.24.12, 1.25.6 or higher.
References
Denial of Service (DoS)
Detailed paths
Overview
std/net/url is a Go standard library package std/net/url
Affected versions of this package are vulnerable to Denial of Service (DoS).
Go Vulnerability Report:
Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.
Details
Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.
Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.
One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.
When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.
Two common types of DoS vulnerabilities:
High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm
wspackage
Remediation
Upgrade std/net/url to version 1.25.13, 1.26.6, 1.27.0-rc.3 or higher.
References
Symlink Attack
Detailed paths
Overview
std/os is a Go standard library package std/os
Affected versions of this package are vulnerable to Symlink Attack.
Go Vulnerability Report:
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
Remediation
Upgrade std/os to version 1.25.12, 1.26.5, 1.27.0-rc.2 or higher.