[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
golang.org/x/text	v0.3.6 → v0.3.8

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

• PR contains the label that identifies the chart, e.g. chart/<chart-name>

---

golang.org/x/text/language Denial of service via crafted Accept-Language header

CVE-2022-32149 / GHSA-69ch-w2m2-3vjp

More information

Details

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten to fix this behavior for various reasons. Instead the solution implemented in this CL is to limit the total complexity of tags passed into ParseAcceptLanguage by limiting the number of dashes in the string to 1000. This should be more than enough for the majority of real world use cases, where the number of tags being sent is likely to be in the single digits.

Specific Go Packages Affected

golang.org/x/text/language

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-32149
• https://go.dev/cl/442235
• https://go.dev/issue/56152
• https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ
• https://pkg.go.dev/vuln/GO-2022-1059
• https://github.com/golang/go/issues/56152
• https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c
• https://security.netapp.com/advisory/ntap-20230203-0006
• https://github.com/advisories/GHSA-69ch-w2m2-3vjp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

golang.org/x/text/language Out-of-bounds Read vulnerability

CVE-2021-38561 / GHSA-ppp9-7jff-5vj2

More information

Details

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-38561
• https://deps.dev/advisory/OSV/GO-2021-0113
• https://go.googlesource.com/text/+/383b2e75a7a4198c42f8f87833eefb772868a56f
• https://groups.google.com/g/golang-announce
• https://pkg.go.dev/golang.org/x/text/language
• https://go.dev/cl/340830
• https://pkg.go.dev/vuln/GO-2021-0113
• https://github.com/advisories/GHSA-ppp9-7jff-5vj2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
golang.org/x/sys	v0.0.0-20220330033206-e17cdc41300f -> v0.0.0-20220722155257-8c9f86f7a55f