تخطَّ إلى المحتوى
QuenchWorks

VEXeasegress

easegress

1 بيان, صدرت في .كل بيان نتيجةٌ من الماسح غير قابلة للاستغلال في هذه الصورة، مع السبب.

الصورةOpenVEX JSON

@id https://quench-works.com/vex/easegress/2026-11-01

  1. GHSA-2hw4-c9m4-f2fj

    غير متأثر · الشيفرة المعرّضة غير موجودة
    • pkg v0.0.0-20231102061027-a6c730fd81f7

    The advisory is the missing http.MaxBytesReader in the admission webhook handler, knative.dev/pkg/webhook/admission.go:109-117. Easegress reaches knative.dev/pkg only indirectly (go.mod line 382, via knative.dev/serving and knative.dev/client for the FaaS controller) and links API, logging, controller and injection packages of it. Verified with `go list -deps ./cmd/server ./cmd/client` at v2.9.4, v2.10.1 and v2.11.0: 30 knative.dev/pkg packages each, zero under knative.dev/pkg/webhook. The recipe runs the same go list after the build and fails if knative.dev/pkg/webhook is ever linked.