Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[🐸 Frogbot] Update version of golang.org/x/net to [0.13.0] #893

Merged
merged 2 commits into from
Aug 11, 2023

Conversation

github-actions[bot]
Copy link
Contributor

📦 Vulnerable Dependencies

✍️ Summary

SEVERITY DIRECT DEPENDENCIES IMPACTED DEPENDENCY FIXED VERSIONS

Medium
golang.org/x/net:v0.12.0

github.com/go-git/go-git/v5:v5.8.1

github.com/jfrog/jfrog-client-go:v1.31.4
golang.org/x/net:v0.12.0 [0.13.0]

👇 Details

  • Severity 🎃 Medium
  • Package Name: golang.org/x/net
  • Current Version: v0.12.0
  • Fixed Version: [0.13.0]
  • CVE: CVE-2023-3978

Description:

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.


@yahavi yahavi merged commit d3c2f3c into dev Aug 11, 2023
13 of 14 checks passed
@yahavi yahavi deleted the frogbot-golang.org/x/net-78a6fe11f8021e24b7f196d7f85790d7 branch August 11, 2023 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants