chubaofs/chubaofs 软件分析报告

基础信息

项目名称:chubaofs/chubaofs

项目徽章:

Security Status

仓库地址:https://github.com/pterodactyl/panel

检测报告地址:https://www.murphysec.com/console/report/1716668725104263168/1716668725209120768

此报告由Murphysec提供

漏洞列表

漏洞名称 漏洞类型 MPS编号 CVE编号 漏洞等级
Kubernetes API Server 资源管理错误漏洞 循环内过多的平台资源消耗 MPS-2020-44793 CVE-2019-11254 中危
gopkg.in/yaml.v2 存在拒绝服务漏洞 拒绝服务 MPS-2022-13505 中危
boto3 存在信息暴露漏洞 未授权敏感信息泄露 MPS-2022-14769 低危
Go-Yaml 安全漏洞 MPS-2022-52765 CVE-2021-4235 中危
Go-Yaml 资源管理错误漏洞 拒绝服务 MPS-2022-69639 CVE-2022-3064 高危
Google Go 权限许可和访问控制问题漏洞 权限管理不当 MPS-2022-9049 CVE-2022-29526 中危

缺陷组件

组件名称 版本 最小修复版本 依赖关系 修复建议
gopkg.in/yaml.v2 v2.2.2 2.2.8 直接依赖 建议修复
golang.org/x/sys v0.0.0-20220209214540-3681064d5158 0.1.0 直接依赖 可选修复
boto3 1.0.0 1.4.5 间接依赖 可选修复

许可证风险

许可证类型 相关组件 许可证风险
Apache-2.0 40
MIT 54
BSD-3-Clause 32
GPLv2 1
BSD-2-Clause 3
LGPL-2.1 1
MPL-2.0 9
自定义许可证 4
ISC 1
Zlib 1
BSD-2-Clause-Views 1
GPL-2.0-only 1
HPND 1

SBOM清单

组件名称 组件版本 是否直接依赖 仓库
github.com/jacobsa/oglematchers v0.0.0-20150720000706-141901ea67cd 直接依赖 go
jekyll-seo-tag 2.1.0 间接依赖 bundler
github.com/eapache/go-xerial-snappy v0.0.0-20230111030713-bf00bc1b83b6 间接依赖 go
coffee-script-source 1.12.2 间接依赖 bundler
github.com/jacobsa/syncutil v0.0.0-20180201203307-228ac8e5a6c3 直接依赖 go
github.com/desertbit/columnize v2.1.0+incompatible 间接依赖 go
github.com/brahma-adshonor/gohook v1.1.9 直接依赖 go
github.com/stretchr/testify v1.8.2 直接依赖 go
github.com/desertbit/go-shlex v0.1.1 间接依赖 go
google.golang.org/grpc v1.35.0 间接依赖 go
octokit 4.4.1 间接依赖 bundler
github-pages-health-check 1.2.0 间接依赖 bundler
github.com/dustin/go-humanize v1.0.1 直接依赖 go
github.com/hashicorp/go-hclog v1.5.0 间接依赖 go
golang.org/x/crypto v0.0.0-20220214200702-86341886e292 间接依赖 go
github.com/prometheus/client_model v0.2.0 间接依赖 go
busybox 间接依赖
github.com/kahing/go-xattr v1.1.1 直接依赖 go
github.com/kylelemons/godebug v1.1.0 直接依赖 go
net.java.dev.jna:jna 5.6.0 直接依赖 maven
gemoji 2.1.0 间接依赖 bundler
github.com/hashicorp/go-uuid v1.0.3 间接依赖 go
github.com/eapache/queue v1.1.0 间接依赖 go
faraday 0.15.2 间接依赖 bundler
i18n 0.7.0 间接依赖 bundler
addressable 2.4.0 间接依赖 bundler
github.com/spf13/pflag v1.0.5 间接依赖 go
github.com/tklauser/numcpus v0.6.0 间接依赖 go
tzinfo 1.2.2 间接依赖 bundler
github.com/spf13/cobra v1.5.0 直接依赖 go
gopkg.in/bsm/ratelimit.v1 v1.0.0-20170922094635-f56db5e73a5e 直接依赖 go
jekyll-sass-converter 1.3.0 间接依赖 bundler
github.com/samsarahq/thunder v0.0.0-20211005041752-96f4331b7baa 直接依赖 go
golang.org/x/arch v0.0.0-20190312162104-788fe5ffcd8c 间接依赖 go
go.etcd.io/etcd/raft/v3 v3.5.8 直接依赖 go
github.com/bits-and-blooms/bitset v1.2.1 直接依赖 go
github.com/go-ole/go-ole v1.2.6 间接依赖 go
gopkg.in/natefinch/lumberjack.v2 v2.0.0 直接依赖 go
launchpad.net/gocheck v0.0.0-20140225173054-000000000087 间接依赖 go
github.com/mitchellh/go-homedir v1.1.0 直接依赖 go
html-pipeline 2.4.2 间接依赖 bundler
github.com/hashicorp/errwrap v1.1.0 间接依赖 go
gopkg.in/go-playground/validator.v9 v9.31.0 直接依赖 go
github.com/hashicorp/go-immutable-radix v1.3.1 间接依赖 go
google.golang.org/protobuf v1.28.1 间接依赖 go
colorator 1.1.0 间接依赖 bundler
github.com/graphql-go/graphql v0.8.0 间接依赖 go
github.com/inconshreveable/mousetrap v1.0.0 直接依赖 go
github.com/prometheus/client_golang v1.13.0 直接依赖 go
github.com/edsrzf/mmap-go v1.1.0 直接依赖 go
safe_yaml 1.0.4 间接依赖 bundler
github.com/cespare/xxhash/v2 v2.1.2 间接依赖 go
jekyll-sitemap 0.12.0 间接依赖 bundler
github.com/afex/hystrix-go v0.0.0-20180502004556-fa1af6a1f4f5 直接依赖 go
github.com/mattn/go-colorable v0.1.13 间接依赖 go
minitest 5.9.1 间接依赖 bundler
github.com/mattn/go-isatty v0.0.18 间接依赖 go
github.com/Shopify/sarama v1.33.0 直接依赖 go
k8s.io/klog/v2 v2.90.1 间接依赖 go
github.com/desertbit/grumble v1.1.3 直接依赖 go
github.com/hashicorp/consul/api v1.15.2 直接依赖 go
rouge 1.11.1 间接依赖 bundler
rb-fsevent 0.9.8 间接依赖 bundler
github.com/leodido/go-urn v1.2.3 间接依赖 go
github.com/xtaci/smux v1.5.16 直接依赖 go
github.com/gorilla/mux v1.8.0 直接依赖 go
github.com/google/btree v1.0.1 直接依赖 go
github.com/golang/mock v1.6.0 直接依赖 go
gopkg.in/yaml.v2 v2.4.0 直接依赖 go
golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 直接依赖 go
google.golang.org/genproto v0.0.0-20200825200019-8632dd797987 间接依赖 go
rb-inotify 0.9.7 间接依赖 bundler
github.com/spf13/pflag v1.0.3 直接依赖 go
github.com/go-logr/logr v1.2.3 间接依赖 go
github.com/jmespath/go-jmespath v0.3.0 间接依赖 go
jekyll-github-metadata 2.2.0 间接依赖 bundler
github.com/moby/sys/mountinfo v0.6.2 间接依赖 go
github.com/aws/aws-sdk-go v1.33.1 直接依赖 go
github.com/julienschmidt/httprouter v1.3.0 直接依赖 go
github.com/hashicorp/go-rootcerts v1.0.2 间接依赖 go
github.com/gogo/protobuf v1.3.2 间接依赖 go
github.com/mitchellh/mapstructure v1.5.0 间接依赖 go
github.com/jcmturner/gokrb5/v8 v8.4.2 间接依赖 go
github.com/prometheus/common v0.37.0 间接依赖 go
sawyer 0.7.0 间接依赖 bundler
jekyll-gist 1.4.0 间接依赖 bundler
github.com/hashicorp/go-cleanhttp v0.5.2 间接依赖 go
mercenary 0.3.6 间接依赖 bundler
jekyll-redirect-from 0.11.0 间接依赖 bundler
ethon 0.11.0 间接依赖 bundler
kramdown 1.11.1 间接依赖 bundler
github.com/benbjohnson/clock v1.3.1 直接依赖 go
gopkg.in/go-playground/assert.v1 v1.2.1 间接依赖 go
github.com/opentracing/opentracing-go v1.2.0 直接依赖 go
jekyll-avatar 0.4.2 间接依赖 bundler
github.com/golang/snappy v0.0.4 间接依赖 go
github.com/klauspost/cpuid/v2 v2.1.1 间接依赖 go
github.com/jcmturner/rpc/v2 v2.0.3 间接依赖 go
github.com/google/uuid v1.3.0 直接依赖 go
github.com/samsarahq/go v0.0.0-20181026175739-13570df44b46 间接依赖 go
github.com/beorn7/perks v1.0.1 间接依赖 go
github.com/rs/xid v1.5.0 直接依赖 go
nokogiri 间接依赖 bundler
github.com/facebookgo/stack v0.0.0-20160209184415-751773369052 间接依赖 go
github.com/klauspost/compress v1.15.0 间接依赖 go
github.com/pierrec/lz4 v2.6.1+incompatible 间接依赖 go
gopkg.in/yaml.v3 v3.0.1 间接依赖 go
github.com/jcmturner/aescts/v2 v2.0.0 间接依赖 go
github.com/gorilla/websocket v1.4.2 间接依赖 go
github.com/deniswernert/go-fstab v0.0.0-20141204152952-eb4090f26517 直接依赖 go
golang.org/x/sys v0.7.0 直接依赖 go
activesupport 4.2.7 间接依赖 bundler
github.com/shirou/gopsutil v3.21.11+incompatible 直接依赖 go
golang.org/x/sys v0.0.0-20220209214540-3681064d5158 直接依赖 go
jemoji 0.7.0 间接依赖 bundler
github.com/davecgh/go-spew v1.1.1 间接依赖 go
zstd 间接依赖
k8s.io/utils v0.0.0-20230313181309-38a27ef9d749 间接依赖 go
boto3 1.0.0 间接依赖 pip
jekyll-coffeescript 1.0.1 间接依赖 bundler
github.com/prometheus/procfs v0.8.0 间接依赖 go
github.com/facebookgo/subset v0.0.0-20200203212716-c811ad88dec4 间接依赖 go
go.uber.org/automaxprocs v1.5.1 直接依赖 go
github.com/jacobsa/ogletest v0.0.0-20170503003838-80d50a735a11 直接依赖 go
listen 3.0.6 间接依赖 bundler
k8s.io/mount-utils v0.26.2 直接依赖 go
zlib 间接依赖
github.com/jcmturner/dnsutils/v2 v2.0.0 间接依赖 go
github-pages 104 间接依赖 bundler
multipart-post 2.0.0 间接依赖 bundler
github.com/jacobsa/timeutil v0.0.0-20170205232429-577e5acbbcf6 直接依赖 go
github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 间接依赖 go
github.com/tklauser/go-sysconf v0.3.11 间接依赖 go
gopkg.in/yaml.v2 v2.2.2 直接依赖 go
minima 2.0.0 间接依赖 bundler
github.com/desertbit/readline v1.5.1 间接依赖 go
github.com/matttproud/golang_protobuf_extensions v1.0.1 间接依赖 go
github.com/spf13/viper v1.4.0 直接依赖 go
github.com/klauspost/reedsolomon v1.11.7 直接依赖 go
github.com/jacobsa/daemonize v0.0.0-20160101105449-e460293e890f 直接依赖 go
github.com/hashicorp/golang-lru v0.5.4 直接依赖 go
github.com/yusufpapurcu/wmi v1.2.3 间接依赖 go
rocksdb 6.0.2 间接依赖
jekyll-swiss 0.4.0 间接依赖 bundler
github.com/desertbit/closer/v3 v3.1.2 间接依赖 go
jekyll-feed 0.8.0 间接依赖 bundler
json 1.8.3 间接依赖 bundler
liquid 3.0.6 间接依赖 bundler
terminal-table 1.7.3 间接依赖 bundler
jekyll-paginate 1.1.0 间接依赖 bundler
github.com/hashicorp/go-multierror v1.1.1 间接依赖 go
github.com/jacobsa/fuse v0.0.0-20220130133955-108387eec147 直接依赖 go
golang.org/x/net v0.8.0 直接依赖 go
thread_safe 0.3.5 间接依赖 bundler
sass 3.4.22 间接依赖 bundler
github.com/spf13/cobra v1.2.1 直接依赖 go
jekyll 3.8.4 间接依赖 bundler
forwardable-extended 2.6.0 间接依赖 bundler
github.com/facebookgo/ensure v0.0.0-20200202191622-63f1cf65ac4c 间接依赖 go
github.com/BurntSushi/toml v1.1.0 间接依赖 go
github.com/go-playground/locales v0.14.1 间接依赖 go
golang.org/x/text v0.6.0 直接依赖 go
github.com/tecbot/gorocksdb v0.0.0-20191217155057-f0fad39f321c 直接依赖 go
github.com/cpuguy83/go-md2man/v2 v2.0.0 直接依赖 go
golang.org/x/sync v0.1.0 直接依赖 go
ffi 1.9.25 间接依赖 bundler
github.com/fatih/color v1.15.0 直接依赖 go
snappy 间接依赖
github.com/jcmturner/gofork v1.0.0 间接依赖 go
rocksdb 间接依赖
pathutil 0.14.0 间接依赖 bundler
github.com/hashicorp/serf v0.10.1 间接依赖 go
github.com/go-playground/universal-translator v0.18.1 间接依赖 go
github.com/smartystreets/goconvey v1.8.0 间接依赖 go
public_suffix 1.5.3 间接依赖 bundler
jekyll-mentions 1.2.0 间接依赖 bundler
unicode-display_width 1.1.1 间接依赖 bundler
golang.org/x/sys v0.6.0 间接依赖 go
jekyll-watch 1.5.0 间接依赖 bundler
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 间接依赖 go
typhoeus 0.8.0 间接依赖 bundler
coffee-script 2.4.1 间接依赖 bundler
github.com/peterbourgon/diskv/v3 v3.0.1 直接依赖 go
github.com/armon/go-metrics v0.4.1 间接依赖 go
golang.org/x/text v0.8.0 间接依赖 go
github.com/golang/protobuf v1.5.2 直接依赖 go
github.com/eapache/go-resiliency v1.3.0 间接依赖 go
net-dns 0.8.0 间接依赖 bundler
execjs 2.7.0 间接依赖 bundler
(0)
上一篇 2023年10月24日
下一篇 2023年10月24日

相关推荐

  • langhuihui/fastrx 软件分析报告

    基础信息 项目名称:langhuihui/fastrx 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1721356099247439872/1727100446442475520 此报告由Murphysec提供 …

    软件分析 2023年11月22日
    0
  • apache/tvm 软件分析报告

    基础信息 项目名称:apache/tvm 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1715952738277916672/1715952738324054016 此报告由Murphysec提供 漏洞列表 漏洞…

    软件分析 2023年10月23日
    0
  • dotnet/tye 软件分析报告

    基础信息 项目名称:dotnet/tye 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1721142759661834240/1730218274855014400 此报告由Murphysec提供 漏洞列表 漏洞…

    软件分析 2023年11月30日
    0
  • EddyVerbruggen/nativescript-numeric-keyboard 软件分析报告

    基础信息 项目名称:EddyVerbruggen/nativescript-numeric-keyboard 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1717394725501796352/171739472…

    软件分析 2023年10月26日
    0
  • zyclonite/nassh-relay 软件分析报告

    基础信息 项目名称:zyclonite/nassh-relay 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1720432932765609984/1720432932862078976 此报告由Murphyse…

    软件分析 2023年11月3日
    0