基础信息
项目名称：hyperledger/fabric
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1718735013293113344/1718735013356027904
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| 低危 | ||||
| PyPI仓库charset-normalizer组件包内嵌恶意代码 | 内嵌恶意代码 | MPS-67h0-j1fr | 高危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| charset-normalizer | 3.2.0 | 间接依赖 | 强烈建议修复 | |
| github.com/consensys/gnark-crypto | v0.6.0 | 0.12.0 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| MIT | 49 | 低 |
| Apache-2.0 | 46 | 低 |
| BSD-3-Clause | 31 | 低 |
| 自定义许可证 | 9 | 低 |
| BSD-2-Clause | 6 | 低 |
| ISC | 2 | 低 |
| MPL-2.0 | 1 | 低 |
| CC-BY-SA-4.0 | 1 | 中 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| github.com/kr/text | v0.2.0 | 间接依赖 | go |
| github.com/prometheus/procfs | v0.8.0 | 间接依赖 | go |
| github.com/mattn/go-runewidth | v0.0.4 | 间接依赖 | go |
| google.golang.org/protobuf | v1.28.1 | 直接依赖 | go |
| requests | 2.31.0 | 间接依赖 | pip |
| github.com/spf13/cobra | v1.1.3 | 直接依赖 | go |
| github.com/gogo/protobuf | v1.3.2 | 间接依赖 | go |
| packaging | 23.1 | 间接依赖 | pip |
| github.com/pkg/errors | v0.9.1 | 直接依赖 | go |
| github.com/golang/groupcache | v0.0.0-20210331224755-41bb18bfe9da | 间接依赖 | go |
| github.com/hyperledger/fabric-amcl | v0.0.0-20210603140002-2670f91851c8 | 间接依赖 | go |
| github.com/vektra/mockery | v0.0.0-20181123154057-e78b021dcbb5 | 直接依赖 | go |
| MarkupSafe | 2.1.3 | 间接依赖 | pip |
| github.com/stretchr/testify | v1.8.1 | 直接依赖 | go |
| certifi | 2023.7.22 | 间接依赖 | pip |
| github.com/onsi/ginkgo/v2 | v2.1.1 | 直接依赖 | go |
| github.com/syndtr/goleveldb | v1.0.1-0.20210305035536-64b5b1c73954 | 直接依赖 | go |
| github.com/mitchellh/mapstructure | v1.4.3 | 直接依赖 | go |
| github.com/gorilla/mux | v1.8.0 | 直接依赖 | go |
| sphinxcontrib-serializinghtml | 1.1.5 | 间接依赖 | pip |
| github.com/prometheus/client_model | v0.3.0 | 间接依赖 | go |
| github.com/hyperledger/fabric-protos-go | v0.0.0-20190823190507-26c33c998676 | 直接依赖 | go |
| github.com/IBM/idemix | v0.0.0-20220112103229-701e7610d405 | 直接依赖 | go |
| github.com/alecthomas/units | v0.0.0-20210912230133-d1bdfacee922 | 间接依赖 | go |
| go.opencensus.io | v0.22.4 | 间接依赖 | go |
| imagesize | 1.4.1 | 间接依赖 | pip |
| Jinja2 | 3.0.3 | 间接依赖 | pip |
| github.com/spf13/afero | v1.3.1 | 间接依赖 | go |
| github.com/matttproud/golang_protobuf_extensions | v1.0.4 | 间接依赖 | go |
| idna | 3.4 | 间接依赖 | pip |
| github.com/Knetic/govaluate | v3.0.1-0.20171022003610-9aa49832a739+incompatible | 直接依赖 | go |
| github.com/stretchr/objx | v0.5.0 | 间接依赖 | go |
| pytz | 2023.3 | 间接依赖 | pip |
| golang.org/x/sync | v0.1.0 | 间接依赖 | go |
| github.com/pelletier/go-toml | v1.8.1 | 间接依赖 | go |
| github.com/golang/snappy | v0.0.4 | 间接依赖 | go |
| github.com/davecgh/go-spew | v1.1.1 | 直接依赖 | go |
| golang.org/x/crypto | v0.14.0 | 直接依赖 | go |
| github.com/go-swagger/go-swagger | v0.25.0 | 直接依赖 | go |
| github.com/spf13/viper | v1.7.0 | 直接依赖 | go |
| github.com/cespare/xxhash/v2 | v2.2.0 | 间接依赖 | go |
| github.com/spf13/cast | v1.3.1 | 间接依赖 | go |
| github.com/docker/go-units | v0.5.0 | 间接依赖 | go |
| github.com/opencontainers/image-spec | v1.0.2 | 间接依赖 | go |
| github.com/consensys/gnark-crypto | v0.6.0 | 间接依赖 | go |
| github.com/otiai10/copy | v1.6.0 | 直接依赖 | go |
| go.etcd.io/etcd/server/v3 | v3.5.9 | 直接依赖 | go |
| github.com/morikuni/aec | v1.0.0 | 间接依赖 | go |
| github.com/go-logfmt/logfmt | v0.5.1 | 间接依赖 | go |
| github.com/containerd/containerd | v1.5.18 | 间接依赖 | go |
| github.com/grpc-ecosystem/go-grpc-middleware | v1.3.0 | 直接依赖 | go |
| github.com/alecthomas/template | v0.0.0-20190718012654-fb15b899a751 | 间接依赖 | go |
| python-markdown-math | 0.2 | 间接依赖 | pip |
| sphinxcontrib-websupport | 1.2.4 | 间接依赖 | pip |
| github.com/cheggaaa/pb | v1.0.29 | 直接依赖 | go |
| github.com/go-kit/kit | v0.10.0 | 直接依赖 | go |
| Babel | 2.12.1 | 间接依赖 | pip |
| golang.org/x/text | v0.13.0 | 间接依赖 | go |
| github.com/fsouza/go-dockerclient | v1.7.3 | 直接依赖 | go |
| github.com/inconshreveable/mousetrap | v1.0.0 | 间接依赖 | go |
| github.com/tedsuo/ifrit | v0.0.0-20220120221754-dd274de71113 | 直接依赖 | go |
| snowballstemmer | 2.2.0 | 间接依赖 | pip |
| recommonmark | 0.7.1 | 间接依赖 | pip |
| Pygments | 2.15.1 | 间接依赖 | pip |
| go.uber.org/atomic | v1.7.0 | 间接依赖 | go |
| code.cloudfoundry.org/clock | v1.0.0 | 直接依赖 | go |
| github.com/prometheus/client_golang | v1.11.1 | 直接依赖 | go |
| github.com/moby/term | v0.0.0-20201216013528-df9cb8a40635 | 间接依赖 | go |
| github.com/Azure/go-ansiterm | v0.0.0-20170929234023-d6e3b3328b78 | 间接依赖 | go |
| github.com/docker/docker | v20.10.24+incompatible | 间接依赖 | go |
| golang.org/x/lint | v0.0.0-20191125180803-fdd1cda4f05f | 直接依赖 | go |
| go.uber.org/zap | v1.19.0 | 直接依赖 | go |
| github.com/mmcloughlin/addchain | v0.4.0 | 间接依赖 | go |
| github.com/magiconair/properties | v1.8.1 | 间接依赖 | go |
| gopkg.in/yaml.v3 | v3.0.1 | 间接依赖 | go |
| github.com/docker/go-connections | v0.4.0 | 间接依赖 | go |
| github.com/gorilla/handlers | v1.5.1 | 直接依赖 | go |
| github.com/AlekSi/gocov-xml | v0.0.0-20190121064608-3a14fb1c4737 | 直接依赖 | go |
| Sphinx | 1.8.6 | 间接依赖 | pip |
| charset-normalizer | 3.2.0 | 间接依赖 | pip |
| github.com/hashicorp/hcl | v1.0.0 | 间接依赖 | go |
| github.com/VictoriaMetrics/fastcache | v1.9.0 | 直接依赖 | go |
| golang.org/x/tools | v0.1.0 | 直接依赖 | go |
| github.com/Microsoft/go-winio | v0.5.2 | 间接依赖 | go |
| sphinx-rtd-theme | 1.2.2 | 间接依赖 | pip |
| github.com/hyperledger/fabric-protos-go | v0.3.1 | 直接依赖 | go |
| github.com/axw/gocov | v1.0.0 | 直接依赖 | go |
| github.com/golang/protobuf | v1.5.2 | 直接依赖 | go |
| docutils | 0.17.1 | 间接依赖 | pip |
| github.com/hyperledger/fabric-config | v0.2.1 | 直接依赖 | go |
| github.com/IBM/mathlib | v0.0.0-20220112091634-0a7378db6912 | 间接依赖 | go |
| github.com/opencontainers/go-digest | v1.0.0 | 间接依赖 | go |
| gopkg.in/alecthomas/kingpin.v2 | v2.2.6 | 直接依赖 | go |
| github.com/hyperledger/fabric-chaincode-go | v0.0.0-20190823162523-04390e015b85 | 直接依赖 | go |
| github.com/onsi/gomega | v1.19.0 | 直接依赖 | go |
| google.golang.org/grpc | v1.53.0 | 直接依赖 | go |
| gopkg.in/yaml.v2 | v2.4.0 | 直接依赖 | go |
| github.com/client9/misspell | v0.3.4 | 直接依赖 | go |
| sphinxcontrib-jquery | 4.1 | 间接依赖 | pip |
| github.com/containerd/cgroups | v1.0.3 | 间接依赖 | go |
| github.com/rogpeppe/go-internal | v1.9.0 | 间接依赖 | go |
| urllib3 | 1.26.18 | 间接依赖 | pip |
| commonmark | 0.9.1 | 间接依赖 | pip |
| github.com/felixge/httpsnoop | v1.0.1 | 间接依赖 | go |
| github.com/opencontainers/runc | v1.1.5 | 间接依赖 | go |
| github.com/maxbrunsfeld/counterfeiter/v6 | v6.2.2 | 直接依赖 | go |
| mvdan.cc/gofumpt | v0.1.0 | 直接依赖 | go |
| golang.org/x/mod | v0.8.0 | 间接依赖 | go |
| github.com/prometheus/common | v0.32.1 | 间接依赖 | go |
| github.com/spf13/pflag | v1.0.5 | 直接依赖 | go |
| github.com/miekg/pkcs11 | v1.1.1 | 直接依赖 | go |
| github.com/moby/sys/mountinfo | v0.6.2 | 间接依赖 | go |
| github.com/SmartBFT-Go/consensus | v0.0.0-20230907130931-31f018a899a6 | 直接依赖 | go |
| github.com/sirupsen/logrus | v1.9.0 | 间接依赖 | go |
| golang.org/x/net | v0.17.0 | 间接依赖 | go |
| six | 1.16.0 | 间接依赖 | pip |
| github.com/Microsoft/hcsshim | v0.8.25 | 间接依赖 | go |
| golang.org/x/tools | v0.6.0 | 直接依赖 | go |
| github.com/beorn7/perks | v1.0.1 | 间接依赖 | go |
| github.com/dustin/go-humanize | v1.0.0 | 间接依赖 | go |
| google.golang.org/genproto | v0.0.0-20230110181048-76db0878b65f | 间接依赖 | go |
| github.com/moby/sys/mount | v0.2.0 | 间接依赖 | go |
| honnef.co/go/tools | v0.1.1 | 直接依赖 | go |
| gopkg.in/ini.v1 | v1.51.0 | 间接依赖 | go |
| github.com/onsi/gomega | v1.17.0 | 直接依赖 | go |
| alabaster | 0.7.13 | 间接依赖 | pip |
| github.com/bits-and-blooms/bitset | v1.2.1 | 直接依赖 | go |
| github.com/subosito/gotenv | v1.2.0 | 间接依赖 | go |
| github.com/sykesm/zap-logfmt | v0.0.4 | 直接依赖 | go |
| github.com/kr/pretty | v0.3.1 | 直接依赖 | go |
| github.com/onsi/ginkgo/v2 | v2.1.3 | 直接依赖 | go |
| github.com/fsnotify/fsnotify | v1.4.9 | 间接依赖 | go |
| go.etcd.io/etcd/pkg/v3 | v3.5.9 | 间接依赖 | go |
| go.etcd.io/etcd/raft/v3 | v3.5.9 | 直接依赖 | go |
| github.com/hyperledger/fabric-chaincode-go | v0.0.0-20220713164125-8f0791c989d7 | 直接依赖 | go |
| go.uber.org/multierr | v1.6.0 | 间接依赖 | go |
| go.etcd.io/etcd/client/pkg/v3 | v3.5.9 | 直接依赖 | go |
| github.com/hyperledger/fabric-lib-go | v1.0.0 | 直接依赖 | go |
| github.com/spf13/jwalterweatherman | v1.1.0 | 间接依赖 | go |
| golang.org/x/sys | v0.13.0 | 间接依赖 | go |
| github.com/pmezard/go-difflib | v1.0.0 | 间接依赖 | go |