Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix vulnerability: CVE-2020-15114 in etcd v3.3.13+incompatible #10

Merged
merged 1 commit into from
Aug 19, 2020

Conversation

bhamail
Copy link

@bhamail bhamail commented Aug 18, 2020

We're using Viper in nancy, and Viper uses crypt.

During a recent CI build, nancy discovered a vulnerability in the crypt transitive dependency. This PR updates the dependency version to use a newly released update of etcd. This transitive dep is pulled in by github.com/bketelsen/crypt.

Fixes Issue #9

@SVilgelm
Copy link

@bketelsen Hi, could you test it and merge as soon as possible?

@SVilgelm
Copy link

It really blocks a lot of projects

@bketelsen bketelsen merged commit 50dbdc1 into bketelsen:master Aug 19, 2020
@bhamail bhamail deleted the fix_vuln_etcd branch August 24, 2020 19:02
@justmccin justmccin mentioned this pull request Oct 28, 2020
dlorenc pushed a commit to dlorenc/viper that referenced this pull request Dec 17, 2020
This picks up bketelsen/crypt#10. It doesn't look like they've done
a new tag yet, so going to the latest commit (as of 17DEC2020) is about all we can do.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants