CVE-2022-32149: golang.org/x/text < 0.3.8

[MichaelMcAleer]

golang.org/x/text versions before 0.3.8 are vulnerable to CVE-2022-32149:

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

This was flagged in a Whitesource/Mend vulnerability scan. Please update golang.org/x/text in go.mod to a version equal to or higher than 0.3.8.

https://www.cve.org/CVERecord?id=CVE-2022-32149 https://www.mend.io/vulnerability-database/CVE-2022-32149

[MShekow]

From looking at the code, I don't understand why golang.org/x/text is needed at all. It is only used in util.go in a function NeuterAccents() which is never called...

[MShekow]

Would be great if this could be addressed :)

[0x4c6565]

@MShekow added https://github.com/spf13/afero/pull/391 to address this