x/vulndb: potential Go vuln in github.com/argoproj/argo-events: CVE-2022-31054

[GoVulnBot]

CVE-2022-31054 references github.com/argoproj/argo-events, which may be a Go module.

Description:
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.

Links:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2022-31054
• JSON: https://github.com/CVEProject/cvelist/tree/1efa3ce32e8feb055a0e87feef98d16d94ade6ae/2022/31xxx/CVE-2022-31054.json
• Commit: argoproj/argo-events@eaabcb6
• PR: chore: discontinue using ioutil argoproj/argo-events#1966
• Imported by: https://pkg.go.dev/github.com/argoproj/argo-events?tab=importedby
• 8 Uses of deprecated API can be used to cause DoS in user-facing endpoints argoproj/argo-events#1946
• GHSA-5q86-62xr-3r57

See doc/triage.md for instructions on how to triage this report.

packages:
  - module: github.com/argoproj/argo-events
    package: argo-events
description: |
    Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
cves:
  - CVE-2022-31054
links:
    pr: https://github.com/argoproj/argo-events/pull/1966
    commit: https://github.com/argoproj/argo-events/commit/eaabcb6d65022fc34a0cc9ea7f00681abd326b35
    context:
      - https://github.com/argoproj/argo-events/issues/1946
      - https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57

[neild]

Vulnerability in server.

[gopherbot]

Change https://go.dev/cl/592768 mentions this issue: data/reports: unexclude 50 reports

[gopherbot]

Change https://go.dev/cl/607219 mentions this issue: data/reports: unexclude 20 reports (17)