Skip to content

Commit

Permalink
Security issue: resolve GHSA-2c7c-3mj9-8fqh
Browse files Browse the repository at this point in the history
An attacker specifying a large "p2c" value can cause
JSONWebEncryption.Decrypt and JSONWebEncryption.DecryptMulti to
consume large amounts of CPU, causing a DoS.

Update package github.com/coreos/go-oidc to version that requires
fixed version of go-jose. Note that github.com/square/go-jose is
deprecated and has been replaced by github.com/go-jose/go-jose

commands run:
- go get -u github.com/coreos/go-oidc/[email protected]
- go mod tidy -go=1.16

see:
- GHSA-2c7c-3mj9-8fqh
- coreos/go-oidc#399
- https://github.com/square/go-jose
- https://github.com/go-jose/go-jose
  • Loading branch information
Michael Cook committed Jan 18, 2024
1 parent 497467b commit f5db0f2
Show file tree
Hide file tree
Showing 2 changed files with 779 additions and 181 deletions.
35 changes: 6 additions & 29 deletions auth_server/go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -3,55 +3,32 @@ module github.com/cesanta/docker_auth/auth_server
go 1.16

require (
cloud.google.com/go/compute v1.10.0 // indirect
cloud.google.com/go/iam v0.5.0 // indirect
cloud.google.com/go/storage v1.27.0
github.com/PuerkitoBio/goquery v1.5.1 // indirect
cloud.google.com/go/storage v1.29.0
github.com/casbin/casbin/v2 v2.55.1
github.com/cesanta/glog v0.0.0-20150527111657-22eb27a0ae19
github.com/coreos/go-oidc/v3 v3.4.0
github.com/coreos/go-oidc/v3 v3.9.0
github.com/dchest/uniuri v0.0.0-20220929095258-3027df40b6ce
github.com/deckarep/golang-set v1.8.0
github.com/docker/distribution v2.8.1+incompatible
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7
github.com/go-ldap/ldap v3.0.3+incompatible
github.com/go-redis/redis v6.15.9+incompatible
github.com/go-sql-driver/mysql v1.6.0
github.com/go-stack/stack v1.8.1 // indirect
github.com/gobuffalo/genny v0.1.1 // indirect
github.com/gobuffalo/gogen v0.1.1 // indirect
github.com/goccy/go-json v0.9.11 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/google/go-cmp v0.5.9 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.2.0 // indirect
github.com/gorilla/mux v1.8.0 // indirect
github.com/jstemmer/go-junit-report v1.0.0 // indirect
github.com/karrick/godirwalk v1.10.3 // indirect
github.com/klauspost/compress v1.15.11 // indirect
github.com/kr/text v0.2.0 // indirect
github.com/lib/pq v1.10.7
github.com/magefile/mage v1.14.0 // indirect
github.com/mattn/go-sqlite3 v2.0.3+incompatible
github.com/montanaflynn/stats v0.6.6 // indirect
github.com/pelletier/go-toml v1.7.0 // indirect
github.com/schwarmco/go-cartesian-product v0.0.0-20180515110546-d5ee747a6dc9
github.com/sirupsen/logrus v1.9.0 // indirect
github.com/stretchr/testify v1.7.0 // indirect
github.com/syndtr/goleveldb v1.0.0
github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a // indirect
go.mongodb.org/mongo-driver v1.10.2
go.opencensus.io v0.23.0 // indirect
golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be
golang.org/x/net v0.0.0-20220930213112-107f3e3c3b0b
golang.org/x/oauth2 v0.0.0-20220909003341-f21342109be1
golang.org/x/sync v0.0.0-20220929204114-8fcdb60fdcc0 // indirect
golang.org/x/sys v0.0.0-20220928140112-f11e5e49a4ec // indirect
golang.org/x/tools v0.1.12 // indirect
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
google.golang.org/api v0.98.0
google.golang.org/genproto v0.0.0-20220930163606-c98284e70a91 // indirect
golang.org/x/crypto v0.14.0
golang.org/x/net v0.17.0
golang.org/x/oauth2 v0.13.0
google.golang.org/api v0.126.0
gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
gopkg.in/fsnotify.v1 v1.4.7
gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22
gopkg.in/yaml.v2 v2.4.0
Expand Down
Loading

0 comments on commit f5db0f2

Please sign in to comment.