基础信息
项目名称：CovenantSQL/CovenantSQL
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1721108135464140800/1727729725077409792
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| Gorilla Websocket 资源管理错误漏洞 | 拒绝服务 | MPS-2020-16819 | CVE-2020-27813 | 高危 |
| Kubernetes API Server 资源管理错误漏洞 | 循环内过多的平台资源消耗 | MPS-2020-44793 | CVE-2019-11254 | 中危 |
| Gin-Gonic Gin 环境问题漏洞 | HTTP请求走私 | MPS-2021-5932 | CVE-2020-28483 | 高危 |
| github.com/gin-gonic/gin 存在日志输出的转义处理不恰当漏洞 | 日志输出的转义处理不恰当 | MPS-2022-13361 | 中危 | |
| gopkg.in/yaml.v2 存在拒绝服务漏洞 | 拒绝服务 | MPS-2022-13505 | 中危 | |
| Go-Ethereum 代码问题漏洞 | 拒绝服务 | MPS-2022-1762 | CVE-2022-23328 | 高危 |
| Go-Yaml 安全漏洞 | MPS-2022-52765 | CVE-2021-4235 | 中危 | |
| gin 存在安全漏洞 | 注入 | MPS-2022-52767 | CVE-2020-36567 | 中危 |
| Google Golang 资源管理错误漏洞 | MPS-2022-58307 | CVE-2022-41723 | 高危 | |
| btcd 安全漏洞 | 缓冲区溢出 | MPS-2022-63685 | CVE-2022-44797 | 严重 |
| Go-Yaml 资源管理错误漏洞 | 拒绝服务 | MPS-2022-69639 | CVE-2022-3064 | 高危 |
| Google Go 权限许可和访问控制问题漏洞 | 权限管理不当 | MPS-2022-9049 | CVE-2022-29526 | 中危 |
| Gin-Gonic Gin 输入验证错误漏洞 | 输入验证不恰当 | MPS-2023-5119 | CVE-2023-26125 | 高危 |
| Gin 安全漏洞 | 下载代码缺少完整性检查 | MPS-2023-9711 | CVE-2023-29401 | 中危 |
| Geth 安全漏洞 | MPS-9vf8-lakn | CVE-2023-42319 | 高危 | |
| Ethereum Go-ethereum 资源管理错误漏洞 | 拒绝服务 | MPS-acjf-e36w | CVE-2023-40591 | 高危 |
| Google Golang 资源管理错误漏洞 | 拒绝服务 | MPS-c8am-hbny | CVE-2023-39325 | 高危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| gopkg.in/yaml.v2 | v2.2.2 | 2.2.8 | 直接依赖 | 建议修复 |
| github.com/gorilla/websocket | v1.4.0 | 1.4.1 | 直接依赖 | 建议修复 |
| github.com/ethereum/go-ethereum | v1.8.27 | 直接依赖 | 建议修复 | |
| github.com/gin-gonic/gin | v1.4.0 | 1.9.1 | 直接依赖 | 建议修复 |
| golang.org/x/net | v0.0.0-20190620200207-3b0461eec859 | 0.17.0 | 间接依赖 | 建议修复 |
| github.com/btcsuite/btcd | v0.0.0-20190614013741-962a206e94e9 | 0.23.2 | 直接依赖 | 建议修复 |
| golang.org/x/sys | v0.0.0-20210820121016-41cdb8703e55 | 0.1.0 | 直接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| BSD-2-Clause-Views | 1 | 低 |
| LGPL-3.0 | 4 | 中 |
| MIT | 43 | 低 |
| BSD-3-Clause | 13 | 低 |
| Apache-2.0 | 14 | 低 |
| BSD-2-Clause | 9 | 低 |
| MPL-2.0 | 1 | 低 |
| GPL-3.0 | 1 | 中 |
| ISC | 3 | 低 |
| HPND | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| github.com/rcrowley/go-metrics | v0.0.0-20181016184325-3113b8401b8a | 直接依赖 | go |
| github.com/juju/errors | v0.0.0-20190207033735-e65537c515d7 | 间接依赖 | go |
| github.com/ugorji/go | v1.1.4 | 直接依赖 | go |
| github.com/google/go-github | v17.0.0+incompatible | 直接依赖 | go |
| github.com/siddontang/go | v0.0.0-20180604090527-bdc77568d726 | 间接依赖 | go |
| github.com/zserge/metric | v0.1.1-0.20190429132510-b0b64cb7bfea | 直接依赖 | go |
| github.com/dghubble/oauth1 | v0.5.0 | 直接依赖 | go |
| cloud.google.com/go | v0.40.0 | 间接依赖 | go |
| github.com/allegro/bigcache | v1.2.1 | 间接依赖 | go |
| github.com/juju/testing | v0.0.0-20190723135506-ce30eb24acd2 | 间接依赖 | go |
| golang.org/x/oauth2 | v0.0.0-20190604053449-0f29369cfe45 | 直接依赖 | go |
| github.com/cyberdelia/go-metrics-graphite | v0.0.0-20161219230853-39f87cc3b432 | 直接依赖 | go |
| github.com/minio/blake2b-simd | v0.0.0-20160723061019-3f5f724cb5b1 | 直接依赖 | go |
| gopkg.in/gorp.v2 | v2.0.1-0.20180226155812-4df78490a9aa | 直接依赖 | go |
| github.com/xo/usql | v0.7.4 | 直接依赖 | go |
| github.com/hashicorp/golang-lru | v0.5.1 | 直接依赖 | go |
| google.golang.org/grpc | v1.21.1 | 间接依赖 | go |
| github.com/konsorten/go-windows-terminal-sequences | v1.0.2 | 间接依赖 | go |
| github.com/gin-contrib/cors | v1.3.0 | 直接依赖 | go |
| github.com/gorilla/handlers | v1.4.0 | 直接依赖 | go |
| github.com/google/go-querystring | v1.0.0 | 间接依赖 | go |
| gopkg.in/natefinch/npipe.v2 | v2.0.0-20160621034901-c1b8fa8bdcce | 间接依赖 | go |
| github.com/siddontang/go-mysql | v0.0.0-20181028041111-76c059e36c62 | 直接依赖 | go |
| github.com/gorilla/websocket | v1.4.0 | 直接依赖 | go |
| github.com/dghubble/sling | v1.2.0 | 直接依赖 | go |
| github.com/cenkalti/backoff | v2.2.1+incompatible | 间接依赖 | go |
| github.com/lufia/iostat | v0.0.0-20170605150913-9f7362b77ad3 | 直接依赖 | go |
| github.com/CovenantSQL/HashStablePack | v2.0.1-0.20190327095521-90c11134d028+incompatible | 直接依赖 | go |
| github.com/rs/cors | v1.6.0 | 间接依赖 | go |
| github.com/CovenantSQL/sqlparser | v0.0.0-20190618091803-c4a6cf6cebb6 | 直接依赖 | go |
| github.com/xo/tblfmt | v0.0.0-20190609041254-28c54ec42ce8 | 间接依赖 | go |
| github.com/aristanetworks/goarista | v0.0.0-20190607111240-52c2a7864a08 | 间接依赖 | go |
| github.com/philhofer/fwd | v1.0.0 | 间接依赖 | go |
| github.com/pingcap/check | v0.0.0-20190102082844-67f458068fc8 | 间接依赖 | go |
| gopkg.in/go-playground/validator.v9 | v9.29.0 | 直接依赖 | go |
| github.com/gopherjs/gopherjs | v0.0.0-20190430165422-3e4dfb77656c | 间接依赖 | go |
| github.com/go-playground/locales | v0.12.1 | 间接依赖 | go |
| github.com/smartystreets/assertions | v0.0.0-20190401211740-f487f9de1cd3 | 间接依赖 | go |
| github.com/CovenantSQL/beacon | v0.0.0-20190521023351-8402bfe07ece | 直接依赖 | go |
| gopkg.in/mgo.v2 | v2.0.0-20190816093944-a6b53ec6cb22 | 间接依赖 | go |
| go.opencensus.io | v0.22.0 | 间接依赖 | go |
| golang.org/x/sys | v0.0.0-20210820121016-41cdb8703e55 | 直接依赖 | go |
| github.com/siddontang/go-log | v0.0.0-20190221022429-1e957dd83bed | 间接依赖 | go |
| github.com/leodido/go-urn | v1.1.0 | 间接依赖 | go |
| github.com/xo/dburl | v0.0.0-20190203050942-98997a05b24f | 直接依赖 | go |
| github.com/pkg/errors | v0.8.1 | 直接依赖 | go |
| github.com/go-playground/universal-translator | v0.16.0 | 间接依赖 | go |
| github.com/gin-contrib/sse | v0.1.0 | 间接依赖 | go |
| github.com/dghubble/gologin | v2.1.0+incompatible | 直接依赖 | go |
| github.com/prometheus/procfs | v0.0.2 | 直接依赖 | go |
| github.com/ethereum/go-ethereum | v1.8.27 | 直接依赖 | go |
| github.com/btcsuite/btcutil | v0.0.0-20190425235716-9e5f4b9a998d | 直接依赖 | go |
| github.com/smartystreets/goconvey | v0.0.0-20170602164621-9e8dc3f972df | 直接依赖 | go |
| github.com/sourcegraph/jsonrpc2 | v0.0.0-20190106185902-35a74f039c6a | 直接依赖 | go |
| github.com/dghubble/go-twitter | v0.0.0-20190512073027-53f972dc4b06 | 间接依赖 | go |
| github.com/poy/onpar | v0.0.0-20190519213022-ee068f8ea4d1 | 间接依赖 | go |
| github.com/syndtr/goleveldb | v1.0.0 | 直接依赖 | go |
| github.com/go-gorp/gorp | v2.0.1-0.20180226155812-4df78490a9aa+incompatible | 直接依赖 | go |
| gopkg.in/yaml.v2 | v2.2.2 | 直接依赖 | go |
| golang.org/x/net | v0.0.0-20190620200207-3b0461eec859 | 间接依赖 | go |
| github.com/prometheus/client_model | v0.0.0-20190129233127-fd36f4220a90 | 直接依赖 | go |
| github.com/davecgh/go-spew | v1.1.1 | 直接依赖 | go |
| github.com/prometheus/common | v0.6.0 | 直接依赖 | go |
| github.com/apoydence/onpar | v0.0.0-20190519213022-ee068f8ea4d1 | 间接依赖 | go |
| github.com/jordwest/mock-conn | v0.0.0-20180617021051-4896c6bd1641 | 直接依赖 | go |
| github.com/ivpusic/grpool | v1.0.0 | 直接依赖 | go |
| github.com/gorilla/mux | v1.7.2 | 直接依赖 | go |
| github.com/sirupsen/logrus | v1.4.2 | 直接依赖 | go |
| github.com/rakyll/statik | v0.1.6 | 直接依赖 | go |
| google.golang.org/appengine | v1.6.1 | 间接依赖 | go |
| github.com/CovenantSQL/go-sqlite3-encrypt | v1.9.1-0.20190621093938-dc98560308ab | 直接依赖 | go |
| google.golang.org/genproto | v0.0.0-20190620144150-6af8c5fc6601 | 间接依赖 | go |
| github.com/tchap/go-patricia | v2.3.0+incompatible | 直接依赖 | go |
| github.com/derekstavis/go-qs | v0.0.0-20180720192143-9eef69e6c4e7 | 直接依赖 | go |
| github.com/mohae/deepcopy | v0.0.0-20170929034955-c48cc78d4826 | 直接依赖 | go |
| github.com/fortytw2/leaktest | v1.3.0 | 直接依赖 | go |
| github.com/satori/go.uuid | v1.2.1-0.20181028125025-b2ce2384e17b | 直接依赖 | go |
| github.com/btcsuite/btcd | v0.0.0-20190614013741-962a206e94e9 | 直接依赖 | go |
| github.com/xtaci/smux | v1.3.4-0.20190522035559-79b3c96b84d1 | 直接依赖 | go |
| github.com/deckarep/golang-set | v1.7.1 | 间接依赖 | go |
| github.com/jmoiron/jsonq | v0.0.0-20150511023944-e874b168d07e | 直接依赖 | go |
| github.com/juju/loggo | v0.0.0-20190526231331-6e530bcce5d8 | 间接依赖 | go |
| golang.org/x/crypto | v0.0.0-20190621222207-cc06ce4a13d4 | 直接依赖 | go |
| github.com/mattn/go-isatty | v0.0.8 | 间接依赖 | go |
| bazil.org/fuse | v0.0.0-20180421153158-65cc252bf669 | 直接依赖 | go |
| github.com/gin-gonic/gin | v1.4.0 | 直接依赖 | go |
| github.com/prometheus/client_golang | v1.0.1-0.20190623115659-7c68e7286a5c | 直接依赖 | go |
| github.com/jtolds/gls | v4.20.0+incompatible | 间接依赖 | go |