Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/tiagorlampert/CHAOS < 0.0.0-20220716132853-b47438d36e3a
Fixed in
0.0.0-20220716132853-b47438d36e3a· Vendor fix available
Issue
An issue in tiagorlampert CHAOS before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e allows a remote attacker to execute arbitrary code via the unsafe concatenation of the filename argument into the buildStr string without any sanitization or filtering.
Recommended action: Upgrade to 0.0.0-20220716132853-b47438d36e3a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/tiagorlampert/CHAOS < 0.0.0-20220716132853-b47438d36e3a
Fixed in
0.0.0-20220716132853-b47438d36e3a· Vendor fix available
Issue
An issue in tiagorlampert CHAOS v5.0.1 allows a remote attacker to execute arbitrary code via the BuildClient function within clientservice.go
Recommended action: Upgrade to 0.0.0-20220716132853-b47438d36e3a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.