discordgo icon indicating copy to clipboard operation
discordgo copied to clipboard

Update golang.org/x/crypto to v0.22.0 and Minimum Go Version to 1.18 to Address Security Vulnerabilities

Open buckedunicorn opened this issue 10 months ago • 0 comments

Please update the golang.org/x/crypto package to version 0.22.0 and raise the minimum Go version to 1.18.

These changes are needed to address several high and moderate severity security vulnerabilities, specifically CVE-2021-43565, CVE-2022-27191, CVE-2023-48795, and CVE-2022-29526, which were present in the previously used version of the crypto package.

Updating ensures that the DiscordGo library remains secure and up-to-date with the latest security patches and features.

The Go version in CI workflows needs updating to support versions from 1.18 through 1.22, maintaining compatibility with current Go releases.

A minimum version of Go >= 1.18.2 is required to fully address all vulnerabilities listed.

Vulnerabilities covered:

  • CVE-2021-43565
    • Severity: HIGH
    • Package: golang.org/x/crypto from 0.0.0-20210421170649-83a5a9bb288b
    • Advisory: https://github.com/advisories/GHSA-gwc9-m7rh-j2ww
  • CVE-2022-27191
    • Severity: HIGH
    • Package: golang.org/x/crypto from 0.0.0-20210421170649-83a5a9bb288b
    • Advisory: https://github.com/advisories/GHSA-8c26-wmh5-6g9v
  • CVE-2023-48795
    • Severity: Moderate
    • Package: golang.org/x/crypto from 0.0.0-20210421170649-83a5a9bb288b
    • Advisory: https://github.com/advisories/GHSA-45x7-px36-x8w8
  • CVE-2022-29526
    • Severity: Moderate
    • Package: go < 1.18.2 via golang.org/x/sys/unix
    • Advisory: https://github.com/advisories/GHSA-p782-xgp4-8hr8

Validation Steps Proposed:

  • go mod tidy
  • diff <(gofmt -d .) <(echo -n)
  • go vet -x ./...
  • golint -set_exit_status ./...
  • go test -v -race ./...

Originally Proposed PR: https://github.com/bwmarrin/discordgo/pull/1528

buckedunicorn avatar May 02 '24 16:05 buckedunicorn