goharbor/harbor 软件分析报告

基础信息

项目名称:goharbor/harbor

项目徽章:

Security Status

仓库地址:https://github.com/pterodactyl/panel

检测报告地址:https://www.murphysec.com/console/report/1721230651234975744/1726373357043539968

此报告由Murphysec提供

漏洞列表

漏洞名称 漏洞类型 MPS编号 CVE编号 漏洞等级
go.uuid 不安全的随机性漏洞 使用具有密码学弱点缺陷的PRNG MPS-2021-7854 CVE-2021-3538 严重
node-semver 安全漏洞 ReDoS MPS-2022-5166 CVE-2022-25883 高危

缺陷组件

组件名称 版本 最小修复版本 依赖关系 修复建议
github.com/satori/go.uuid v1.2.0 间接依赖 建议修复
semver 6.3.1 7.5.2 间接依赖 可选修复
tslib 2.6.1 间接依赖
tslib 2.3.0 间接依赖

许可证风险

许可证类型 相关组件 许可证风险
Apache-2.0 78
BSD-3-Clause 29
MIT 151
BSD-2-Clause 7
CC-BY-SA-4.0 2
ISC 12
MPL-2.0 4
0BSD 2
Python-2.0 1
CC-BY-4.0 1
PostgreSQL 1
自定义许可证 3

SBOM清单

组件名称 组件版本 是否直接依赖 仓库
lru-cache 5.1.1 间接依赖 npm
k8s.io/client-go v0.26.2 直接依赖 go
github.com/fsnotify/fsnotify v1.4.9 间接依赖 go
github.com/subosito/gotenv v1.2.0 间接依赖 go
github.com/prometheus/client_golang v1.14.0 直接依赖 go
escape-string-regexp 1.0.5 间接依赖 npm
@cds/core 6.4.2 间接依赖 npm
k8s.io/api v0.26.2 直接依赖 go
github.com/vmihailenco/tagparser v0.1.2 间接依赖 go
@nodelib/fs.walk 1.2.8 间接依赖 npm
github.com/go-openapi/swag v0.19.14 直接依赖 go
cloud.google.com/go/compute v1.18.0 间接依赖 go
github.com/gorilla/mux v1.8.0 直接依赖 go
go.opentelemetry.io/otel/metric v1.19.0 间接依赖 go
@babel/parser 7.23.0 间接依赖 npm
@angular/forms 16.2.12 间接依赖 npm
github.com/docker/go-metrics v0.0.1 间接依赖 go
github.com/matttproud/golang_protobuf_extensions v1.0.4 间接依赖 go
zone.js 0.13.0 间接依赖 npm
github.com/go-openapi/validate v0.19.10 直接依赖 go
@types/trusted-types 2.0.3 间接依赖 npm
yallist 3.1.1 间接依赖 npm
github.com/golang-jwt/jwt/v4 v4.4.2 直接依赖 go
github.com/gocarina/gocsv v0.0.0-20210516172204-ca9e8a8ddea8 直接依赖 go
sigs.k8s.io/yaml v1.3.0 直接依赖 go
@babel/helper-hoist-variables 7.22.5 间接依赖 npm
wrap-ansi 7.0.0 间接依赖 npm
github.com/hashicorp/golang-lru v0.5.4 间接依赖 go
Popen 间接依赖 pip
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.3.0 直接依赖 go
@jridgewell/set-array 1.1.2 间接依赖 npm
github.com/Azure/go-autorest/logger v0.2.1 间接依赖 go
tslib 2.3.0 间接依赖 npm
github.com/mattn/go-runewidth v0.0.9 间接依赖 go
ngx-window-token 6.0.0 间接依赖 npm
debug 4.3.4 间接依赖 npm
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux v0.45.0 直接依赖 go
google.golang.org/api v0.110.0 间接依赖 go
github.com/shiena/ansicolor v0.0.0-20200904210342-c7312218db18 间接依赖 go
@jridgewell/sourcemap-codec 1.4.14 间接依赖 npm
string-width 4.2.3 间接依赖 npm
@babel/highlight 7.22.13 间接依赖 npm
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 直接依赖 go
MigratioNotFound 间接依赖 pip
@angular/compiler 16.2.12 间接依赖 npm
yargs-parser 21.1.1 间接依赖 npm
github.com/google/gofuzz v1.2.0 间接依赖 go
github.com/Azure/go-autorest/tracing v0.6.0 间接依赖 go
@nodelib/fs.stat 2.0.5 间接依赖 npm
micromatch 4.0.5 间接依赖 npm
github.com/jackc/pgproto3/v2 v2.3.2 间接依赖 go
@jridgewell/trace-mapping 0.3.17 间接依赖 npm
supports-color 5.5.0 间接依赖 npm
echarts 5.4.3 间接依赖 npm
ansi-styles 4.3.0 间接依赖 npm
github.com/go-logr/logr v1.2.4 间接依赖 go
update-browserslist-db 1.0.11 间接依赖 npm
emoji-regex 8.0.0 间接依赖 npm
strip-ansi 6.0.1 间接依赖 npm
github.com/hashicorp/hcl v1.0.0 间接依赖 go
PIPE 间接依赖 pip
node-releases 2.0.13 间接依赖 npm
rxjs 7.8.1 间接依赖 npm
github.com/hashicorp/errwrap v1.1.0 间接依赖 go
ansi-styles 3.2.1 间接依赖 npm
github.com/go-openapi/analysis v0.19.10 间接依赖 go
github.com/golang-migrate/migrate/v4 v4.16.2 直接依赖 go
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d 直接依赖 go
github.com/davecgh/go-spew v1.1.1 间接依赖 go
github.com/jackc/pgtype v1.14.0 间接依赖 go
lit 2.6.1 间接依赖 npm
github.com/Azure/go-autorest/autorest/to v0.3.0 间接依赖 go
github.com/prometheus/client_model v0.3.0 间接依赖 go
github.com/stretchr/testify v1.8.4 直接依赖 go
js-yaml 4.1.0 间接依赖 npm
require-directory 2.1.1 间接依赖 npm
@angular/platform-browser 16.2.12 间接依赖 npm
@babel/types 7.23.0 间接依赖 npm
google.golang.org/protobuf v1.28.1 间接依赖 go
gopkg.in/h2non/gock.v1 v1.0.16 直接依赖 go
escalade 3.1.1 间接依赖 npm
github.com/go-openapi/loads v0.19.5 直接依赖 go
@babel/helper-split-export-declaration 7.22.6 间接依赖 npm
github.com/spf13/jwalterweatherman v1.1.0 间接依赖 go
@babel/helper-function-name 7.23.0 间接依赖 npm
@babel/template 7.22.15 间接依赖 npm
go.uber.org/atomic v1.7.0 间接依赖 go
run-parallel 1.2.0 间接依赖 npm
github.com/felixge/httpsnoop v1.0.3 间接依赖 go
is-glob 4.0.3 间接依赖 npm
github.com/mitchellh/mapstructure v1.4.3 间接依赖 go
fast-glob 3.3.0 间接依赖 npm
ngx-markdown 16.0.0 间接依赖 npm
to-regex-range 5.0.1 间接依赖 npm
go.opentelemetry.io/otel/trace v1.19.0 直接依赖 go
github.com/tencentcloud/tencentcloud-sdk-go v1.0.62 直接依赖 go
@babel/compat-data 7.22.9 间接依赖 npm
go.opentelemetry.io/otel/sdk v1.8.0 直接依赖 go
github.com/casbin/casbin v1.9.1 直接依赖 go
globals 11.12.0 间接依赖 npm
@babel/helper-string-parser 7.22.5 间接依赖 npm
glob-parent 5.1.2 间接依赖 npm
golang.org/x/text v0.13.0 直接依赖 go
ngx-cookie 6.0.1 间接依赖 npm
picomatch 2.3.1 间接依赖 npm
to-fast-properties 2.0.0 间接依赖 npm
@babel/generator 7.23.0 间接依赖 npm
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 直接依赖 go
golang.org/x/sync v0.3.0 直接依赖 go
@babel/helper-compilation-targets 7.22.15 间接依赖 npm
@clr/ui 15.4.0 间接依赖 npm
github.com/spf13/cast v1.5.0 间接依赖 go
github.com/jackc/pgconn v1.14.0 直接依赖 go
github.com/Azure/go-autorest/autorest v0.11.27 间接依赖 go
@jridgewell/gen-mapping 0.3.3 间接依赖 npm
lit-element 3.2.2 间接依赖 npm
github.com/gorilla/securecookie v1.1.1 间接依赖 go
go.opentelemetry.io/otel v1.19.0 直接依赖 go
google.golang.org/grpc v1.53.0 间接依赖 go
go.uber.org/ratelimit v0.2.0 直接依赖 go
github.com/denverdino/aliyungo v0.0.0-20191227032621-df38c6fa730c 间接依赖 go
github.com/gogo/protobuf v1.3.2 间接依赖 go
github.com/spf13/viper v1.8.1 直接依赖 go
github.com/grpc-ecosystem/grpc-gateway v1.16.0 间接依赖 go
ramda 0.29.0 间接依赖 npm
github.com/go-logr/stdr v1.2.2 间接依赖 go
k8s.io/utils v0.0.0-20230220204549-a5ecb0141aa5 间接依赖 go
github.com/ncw/swift v1.0.49 间接依赖 go
cron-validator 1.3.1 间接依赖 npm
github.com/olekukonko/tablewriter v0.0.5 直接依赖 go
github.com/stretchr/testify v1.6.0 直接依赖 go
golang.org/x/term v0.13.0 间接依赖 go
search 间接依赖 pip
github.com/opencontainers/go-digest v1.0.0 直接依赖 go
github.com/satori/go.uuid v1.2.0 间接依赖 go
github.com/go-asn1-ber/asn1-ber v1.5.1 直接依赖 go
cliui 8.0.1 间接依赖 npm
github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 直接依赖 go
github.com/beego/i18n v0.0.0-20140604031826-e87155e8f0c0 直接依赖 go
convert-source-map 2.0.0 间接依赖 npm
@babel/helper-module-imports 7.22.15 间接依赖 npm
argparse 2.0.1 间接依赖 npm
is-number 7.0.0 间接依赖 npm
github.com/robfig/cron v1.0.0 间接依赖 go
@clr/angular 15.4.0 间接依赖 npm
config_dir 间接依赖 pip
jsesc 2.5.2 间接依赖 npm
github.com/gocraft/work v0.5.1 直接依赖 go
FileSystemLoader 间接依赖 pip
github.com/beorn7/perks v1.0.1 间接依赖 go
@babel/helper-module-transforms 7.23.0 间接依赖 npm
templates_dir 间接依赖 pip
github.com/mailru/easyjson v0.7.6 间接依赖 go
helm.sh/helm/v3 v3.11.3 直接依赖 go
@ampproject/remapping 2.2.1 间接依赖 npm
github.com/dnaeon/go-vcr v1.2.0 间接依赖 go
y18n 5.0.8 间接依赖 npm
github.com/dghubble/sling v1.1.0 直接依赖 go
gopkg.in/square/go-jose.v2 v2.5.1 间接依赖 go
braces 3.0.2 间接依赖 npm
github.com/go-stack/stack v1.8.0 间接依赖 go
go.uber.org/zap v1.19.0 间接依赖 go
google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8 间接依赖 go
@lit/reactive-element 1.6.1 间接依赖 npm
gopkg.in/yaml.v3 v3.0.1 间接依赖 go
github.com/pkg/errors v0.9.1 直接依赖 go
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 间接依赖 go
@clr/icons 13.0.2 间接依赖 npm
github.com/vmihailenco/msgpack/v5 v5.0.0-rc.2 直接依赖 go
go.uber.org/multierr v1.6.0 间接依赖 go
@ngx-translate/http-loader 8.0.0 间接依赖 npm
github.com/gorilla/handlers v1.5.1 直接依赖 go
caniuse-lite 1.0.30001528 间接依赖 npm
github.com/jackc/pgpassfile v1.0.0 间接依赖 go
harbor_server 间接依赖 pip
golang.org/x/oauth2 v0.5.0 直接依赖 go
@jridgewell/resolve-uri 3.1.0 间接依赖 npm
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f 间接依赖 go
github.com/google/uuid v1.3.0 直接依赖 go
github.com/prometheus/common v0.37.0 间接依赖 go
golang.org/x/net v0.17.0 直接依赖 go
github.com/Azure/go-autorest v14.2.0+incompatible 间接依赖 go
@babel/helper-environment-visitor 7.22.20 间接依赖 npm
REDIS_UID 间接依赖 pip
@angular/router 16.2.12 间接依赖 npm
ADMIN_CLIENT 间接依赖 pip
github.com/golang/protobuf v1.5.2 间接依赖 go
github.com/sirupsen/logrus v1.9.2 间接依赖 go
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.3.0 间接依赖 go
github.com/go-openapi/errors v0.19.6 直接依赖 go
github.com/jackc/pgerrcode v0.0.0-20220416144525-469b46aa5efa 间接依赖 go
github.com/json-iterator/go v1.1.12 间接依赖 go
reusify 1.0.4 间接依赖 npm
github.com/stretchr/objx v0.5.0 间接依赖 go
ms 2.1.2 间接依赖 npm
urlencode 间接依赖 pip
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 间接依赖 go
@angular/localize 16.2.12 间接依赖 npm
github.com/jackc/pgio v1.0.0 间接依赖 go
tslib 2.6.1 间接依赖 npm
go.opentelemetry.io/proto/otlp v0.11.0 间接依赖 go
github.com/go-openapi/jsonreference v0.20.0 间接依赖 go
github.com/distribution/reference v0.5.0 间接依赖 go
@nodelib/fs.scandir 2.1.5 间接依赖 npm
go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.3.0 间接依赖 go
github.com/gruntwork-io/terratest v0.28.2 直接依赖 go
@babel/helper-simple-access 7.22.5 间接依赖 npm
color-name 1.1.3 间接依赖 npm
github.com/Masterminds/semver v1.5.0 直接依赖 go
github.com/go-redis/redis/v8 v8.11.4 直接依赖 go
github.com/spf13/afero v1.6.0 间接依赖 go
get-caller-file 2.0.5 间接依赖 npm
commands 间接依赖 pip
gopkg.in/inf.v0 v0.9.1 间接依赖 go
json5 2.2.3 间接依赖 npm
github.com/hashicorp/go-multierror v1.1.1 间接依赖 go
@angular/animations 16.2.12 间接依赖 npm
github.com/cespare/xxhash/v2 v2.2.0 间接依赖 go
github.com/modern-go/reflect2 v1.0.2 间接依赖 go
data_dir 间接依赖 pip
github.com/coreos/go-oidc/v3 v3.0.0 直接依赖 go
yargs 17.7.2 间接依赖 npm
gensync 1.0.0-beta.2 间接依赖 npm
k8s.io/api v0.18.3 直接依赖 go
ansi-regex 5.0.1 间接依赖 npm
github.com/aws/aws-sdk-go v1.34.28 直接依赖 go
DEFAULT_GID 间接依赖 pip
golang.org/x/crypto v0.14.0 直接依赖 go
color-convert 1.9.3 间接依赖 npm
@angular/core 16.2.12 间接依赖 npm
@babel/core 7.23.2 间接依赖 npm
github.com/cenkalti/backoff/v4 v4.1.2 直接依赖 go
github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a 间接依赖 go
github.com/go-openapi/runtime v0.19.20 直接依赖 go
github.com/gomodule/redigo v2.0.0+incompatible 直接依赖 go
copytree 间接依赖 pip
github.com/opencontainers/image-spec v1.1.0-rc2.0.20221005185240-3a7f492d3f1b 直接依赖 go
fill-range 7.0.1 间接依赖 npm
@ngx-translate/core 15.0.0 间接依赖 npm
github.com/graph-gophers/dataloader v5.0.0+incompatible 直接依赖 go
github.com/docker/distribution v2.8.2+incompatible 直接依赖 go
gopkg.in/ini.v1 v1.62.0 间接依赖 go
cloud.google.com/go/compute/metadata v0.2.3 间接依赖 go
merge2 1.4.1 间接依赖 npm
@angular/common 16.2.12 间接依赖 npm
github.com/go-openapi/strfmt v0.19.5 直接依赖 go
go.mongodb.org/mongo-driver v1.7.5 间接依赖 go
github.com/robfig/cron/v3 v3.0.0 直接依赖 go
@babel/code-frame 7.22.13 间接依赖 npm
github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible 间接依赖 go
github.com/beego/beego/v2 v2.0.6 直接依赖 go
github.com/jmespath/go-jmespath v0.4.0 间接依赖 go
github.com/Azure/go-autorest/autorest/adal v0.9.20 间接依赖 go
has-flag 3.0.0 间接依赖 npm
github.com/pmezard/go-difflib v1.0.0 间接依赖 go
g 间接依赖 pip
semver 6.3.1 间接依赖 npm
github.com/opentracing/opentracing-go v1.2.0 间接依赖 go
zrender 5.4.4 间接依赖 npm
golang.org/x/sys v0.13.0 间接依赖 go
lit-html 2.6.1 间接依赖 npm
github.com/Masterminds/semver/v3 v3.2.0 间接依赖 go
Environment 间接依赖 pip
github.com/Unknwon/goconfig v0.0.0-20160216183935-5f601ca6ef4d 间接依赖 go
github.com/jackc/pgx/v4 v4.18.1 直接依赖 go
js-tokens 4.0.0 间接依赖 npm
rmtree 间接依赖 pip
DEFAULT_UID 间接依赖 pip
github.com/go-openapi/jsonpointer v0.19.5 间接依赖 go
queue-microtask 1.2.3 间接依赖 npm
go.opentelemetry.io/otel/exporters/jaeger v1.0.0 直接依赖 go
@lit-labs/ssr-dom-shim 1.0.0 间接依赖 npm
is-extglob 2.1.1 间接依赖 npm
electron-to-chromium 1.4.512 间接依赖 npm
google.golang.org/genproto v0.0.0-20230306155012-7f2fa6fef1f4 间接依赖 go
github.com/gorilla/csrf v1.6.2 直接依赖 go
github.com/andres-erbsen/clock v0.0.0-20160526145045-9e14626cd129 间接依赖 go
github.com/jackc/chunkreader/v2 v2.0.1 间接依赖 go
@babel/helper-validator-identifier 7.22.20 间接依赖 npm
fastq 1.15.0 间接依赖 npm
github.com/aliyun/alibaba-cloud-sdk-go v0.0.0-20190726115642-cd293c93fd97 直接依赖 go
@babel/traverse 7.23.2 间接依赖 npm
github.com/bmatcuk/doublestar v1.1.1 直接依赖 go
gopkg.in/yaml.v2 v2.4.0 直接依赖 go
@angular/platform-browser-dynamic 16.2.12 间接依赖 npm
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd 间接依赖 go
k8s.io/klog/v2 v2.90.1 间接依赖 go
hurry 间接依赖 pip
quote 间接依赖 pip
ngx-clipboard 15.1.0 间接依赖 npm
github.com/Azure/azure-sdk-for-go v37.2.0+incompatible 间接依赖 go
github.com/go-ldap/ldap/v3 v3.2.4 直接依赖 go
github.com/Azure/go-autorest/autorest/date v0.3.0 间接依赖 go
github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 间接依赖 go
github.com/pelletier/go-toml v1.9.3 间接依赖 go
github.com/google/go-querystring v1.1.0 间接依赖 go
github.com/FZambia/sentinel v1.1.0 直接依赖 go
github.com/cloudevents/sdk-go/v2 v2.13.0 直接依赖 go
@babel/helper-validator-option 7.22.15 间接依赖 npm
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 直接依赖 go
google.golang.org/appengine v1.6.7 间接依赖 go
github.com/go-openapi/spec v0.19.8 直接依赖 go
github.com/Azure/go-ntlmssp v0.0.0-20200615164410-66371956d46c 间接依赖 go
github.com/magiconair/properties v1.8.5 间接依赖 go
k8s.io/apimachinery v0.26.2 直接依赖 go
picocolors 1.0.0 间接依赖 npm
github.com/jpillora/backoff v1.0.0 直接依赖 go
is-fullwidth-code-point 3.0.0 间接依赖 npm
browserslist 4.21.10 间接依赖 npm
@babel/helpers 7.23.2 间接依赖 npm
chalk 2.4.2 间接依赖 npm
github.com/prometheus/procfs v0.8.0 间接依赖 go
github.com/josharian/intern v1.0.0 间接依赖 go
github.com/spf13/pflag v1.0.5 间接依赖 go
(0)
上一篇 2023年11月20日
下一篇 2023年11月20日

相关推荐

  • klinker24/talon-twitter-holo 软件分析报告

    基础信息 项目名称:klinker24/talon-twitter-holo 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1721342296485351424/1724479697351827456 此报告由M…

    软件分析 2023年11月15日
    0
  • ekdevdes/storage.js 软件分析报告

    基础信息 项目名称:ekdevdes/storage.js 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1717415121089331200/1717415121294852096 此报告由Murphysec提…

    软件分析 2023年10月26日
    0
  • IBM/carbon-components-angular 软件分析报告

    基础信息 项目名称:IBM/carbon-components-angular 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1718754409432530944/1718754409499639808 此报告由…

    软件分析 2023年10月30日
    0
  • schollz/croc 软件分析报告

    基础信息 项目名称:schollz/croc 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1744046315100581888/1744046315452903424 此报告由Murphysec提供 漏洞列表 …

    软件分析 2024年1月8日
    0
  • fullstack-kingj/front-end-notes 软件分析报告

    基础信息 项目名称:fullstack-kingj/front-end-notes 项目徽章: 仓库地址:https://github.com/pterodactyl/panel 检测报告地址:https://www.murphysec.com/console/report/1721213403246100480/1730967370645590016 此报…

    软件分析 2023年12月2日
    0