Vulnerability in the software - CVE-2020-14040

[csib]

Version: 2.0.4 Details:

+-------------------+------------------+----------+-------------------+---------------+---------------------------------------+ | LIBRARY | VULNERABILITY ID | SEVERITY | INSTALLED VERSION | FIXED VERSION | TITLE | +-------------------+------------------+----------+-------------------+---------------+---------------------------------------+ | golang.org/x/text | CVE-2020-14040 | HIGH | v0.3.2 | 0.3.3 | golang.org/x/text: possibility | | | | | | | to trigger an infinite loop in | | | | | | | encoding/unicode could lead to... | | | | | | | -->avd.aquasec.com/nvd/cve-2020-14040 | +-------------------+------------------+----------+-------------------+---------------+---------------------------------------+

[kierenevans]

It looks like https://github.com/hipages/php-fpm_exporter/pull/193 should fix this, though that PR will need a rebase to pick up the github action fixes

[ivan-morhun]

Vulnerability still exists:

Component Name: golang.org/x/text
Component Version: v0.3.7
golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags
Target: php-fpm_exporter
Type: gobinary
Fixed version: 0.3.8