基础信息
项目名称：ktr0731/evans
项目徽章：
仓库地址：https://github.com/pterodactyl/panel
检测报告地址：https://www.murphysec.com/console/report/1721349577407025152/1728647688469569536
此报告由Murphysec提供
漏洞列表
| 漏洞名称 | 漏洞类型 | MPS编号 | CVE编号 | 漏洞等级 |
|---|---|---|---|---|
| nFPM 安全漏洞 | 缺省权限不正确 | MPS-28ut-1740 | CVE-2023-32698 | 高危 |
| Google Golang 资源管理错误漏洞 | 拒绝服务 | MPS-c8am-hbny | CVE-2023-39325 | 高危 |
缺陷组件
| 组件名称 | 版本 | 最小修复版本 | 依赖关系 | 修复建议 |
|---|---|---|---|---|
| github.com/goreleaser/nfpm/v2 | v2.18.1 | 2.29.0 | 间接依赖 | 建议修复 |
| golang.org/x/net | v0.10.0 | 0.17.0 | 间接依赖 | 可选修复 |
许可证风险
| 许可证类型 | 相关组件 | 许可证风险 |
|---|---|---|
| Apache-2.0 | 67 | 低 |
| BSD-3-Clause | 33 | 低 |
| MIT | 85 | 低 |
| BSD-2-Clause | 8 | 低 |
| MPL-2.0 | 7 | 低 |
| ISC | 1 | 低 |
SBOM清单
| 组件名称 | 组件版本 | 是否直接依赖 | 仓库 |
|---|---|---|---|
| github.com/tj/go-spin | v1.1.0 | 直接依赖 | go |
| github.com/googleapis/enterprise-certificate-proxy | v0.2.0 | 间接依赖 | go |
| github.com/go-git/gcfg | v1.5.0 | 间接依赖 | go |
| github.com/charmbracelet/lipgloss | v0.5.1-0.20220615005615-2e17a8a06096 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2 | v1.16.2 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream | v1.4.1 | 间接依赖 | go |
| github.com/russross/blackfriday/v2 | v2.1.0 | 间接依赖 | go |
| github.com/jhump/protoreflect | v1.14.0 | 直接依赖 | go |
| github.com/slack-go/slack | v0.11.2 | 间接依赖 | go |
| github.com/go-git/go-git/v5 | v5.4.2 | 间接依赖 | go |
| github.com/k0kubun/pp | v3.0.1+incompatible | 直接依赖 | go |
| github.com/pkg/term | v1.2.0-beta.2 | 间接依赖 | go |
| github.com/caarlos0/ctrlc | v1.2.0 | 间接依赖 | go |
| cloud.google.com/go/compute | v1.12.1 | 间接依赖 | go |
| github.com/desertbit/timer | v0.0.0-20180107155436-c41aec40b27f | 间接依赖 | go |
| github.com/magiconair/properties | v1.8.6 | 间接依赖 | go |
| github.com/Masterminds/semver | v1.5.0 | 间接依赖 | go |
| google.golang.org/appengine | v1.6.7 | 间接依赖 | go |
| github.com/caarlos0/go-shellwords | v1.0.12 | 间接依赖 | go |
| github.com/mitchellh/mapstructure | v1.5.0 | 间接依赖 | go |
| github.com/inconshreveable/mousetrap | v1.0.1 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/service/kms | v1.16.3 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/internal/configsources | v1.1.9 | 间接依赖 | go |
| github.com/chzyer/readline | v0.0.0-20180603132655-2972be24d48e | 直接依赖 | go |
| github.com/aymanbagabas/go-osc52 | v1.0.3 | 间接依赖 | go |
| github.com/acomagu/bufpipe | v1.0.3 | 间接依赖 | go |
| gopkg.in/warnings.v0 | v0.1.2 | 间接依赖 | go |
| golang.org/x/sys | v0.8.0 | 间接依赖 | go |
| golang.org/x/crypto | v0.9.0 | 间接依赖 | go |
| github.com/muesli/mango-pflag | v0.1.0 | 间接依赖 | go |
| github.com/Azure/go-autorest/tracing | v0.6.0 | 间接依赖 | go |
| github.com/technoweenie/multipartstreamer | v1.0.1 | 间接依赖 | go |
| github.com/ktr0731/grpc-web-go-client | v0.2.8 | 直接依赖 | go |
| github.com/rs/cors | v1.7.0 | 间接依赖 | go |
| github.com/sergi/go-diff | v1.2.0 | 间接依赖 | go |
| github.com/hashicorp/go-multierror | v1.1.1 | 直接依赖 | go |
| github.com/golang-jwt/jwt/v4 | v4.4.1 | 间接依赖 | go |
| github.com/google/go-github/v47 | v47.0.0 | 间接依赖 | go |
| github.com/xanzy/ssh-agent | v0.3.1 | 间接依赖 | go |
| github.com/google/wire | v0.5.0 | 间接依赖 | go |
| github.com/fsnotify/fsnotify | v1.6.0 | 间接依赖 | go |
| github.com/spf13/afero | v1.9.2 | 间接依赖 | go |
| github.com/google/go-querystring | v1.1.0 | 间接依赖 | go |
| github.com/caarlos0/go-reddit/v3 | v3.0.1 | 间接依赖 | go |
| google.golang.org/api | v0.102.0 | 间接依赖 | go |
| github.com/bufbuild/protocompile | v0.1.0 | 直接依赖 | go |
| github.com/atc0005/go-teams-notify/v2 | v2.6.1 | 间接依赖 | go |
| github.com/hashicorp/go-version | v1.6.0 | 直接依赖 | go |
| github.com/Azure/go-autorest/autorest/to | v0.4.0 | 间接依赖 | go |
| github.com/mattn/go-runewidth | v0.0.13 | 间接依赖 | go |
| github.com/goreleaser/goreleaser | v1.11.2 | 直接依赖 | go |
| github.com/Azure/go-autorest/autorest/validation | v0.3.1 | 间接依赖 | go |
| github.com/ktr0731/go-multierror | v0.0.0-20171204182908-b7773ae21874 | 直接依赖 | go |
| github.com/klauspost/compress | v1.15.1 | 间接依赖 | go |
| github.com/Microsoft/go-winio | v0.5.1 | 间接依赖 | go |
| github.com/cavaliergopher/cpio | v1.0.1 | 间接依赖 | go |
| github.com/googleapis/go-type-adapters | v1.0.0 | 间接依赖 | go |
| github.com/mattn/go-colorable | v0.1.13 | 直接依赖 | go |
| github.com/rakyll/statik | v0.1.7 | 直接依赖 | go |
| github.com/iancoleman/orderedmap | v0.2.0 | 间接依赖 | go |
| github.com/jbenet/go-context | v0.0.0-20150711004518-d14ea06fba99 | 间接依赖 | go |
| github.com/aws/aws-sdk-go | v1.43.31 | 间接依赖 | go |
| github.com/pkg/errors | v0.9.1 | 直接依赖 | go |
| github.com/klauspost/pgzip | v1.2.5 | 间接依赖 | go |
| github.com/dghubble/go-twitter | v0.0.0-20211115160449-93a8679adecb | 间接依赖 | go |
| github.com/mitchellh/copystructure | v1.2.0 | 间接依赖 | go |
| gopkg.in/mail.v2 | v2.3.1 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/config | v1.15.3 | 间接依赖 | go |
| github.com/pelletier/go-toml | v1.9.5 | 直接依赖 | go |
| github.com/invopop/jsonschema | v0.6.0 | 间接依赖 | go |
| github.com/mattn/go-pipeline | v0.0.0-20170920030317-cfb87a531e2b | 间接依赖 | go |
| github.com/imdario/mergo | v0.3.13 | 间接依赖 | go |
| github.com/Songmu/gocredits | v0.3.0 | 直接依赖 | go |
| github.com/blakesmith/ar | v0.0.0-20190502131153-809d4375e1fb | 间接依赖 | go |
| github.com/mattn/go-ieproxy | v0.0.1 | 间接依赖 | go |
| github.com/aws/smithy-go | v1.11.2 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/service/internal/presigned-url | v1.9.3 | 间接依赖 | go |
| github.com/spf13/pflag | v1.0.5 | 直接依赖 | go |
| github.com/lucasb-eyer/go-colorful | v1.2.0 | 间接依赖 | go |
| github.com/google/rpmpack | v0.0.0-20220314092521-38642b5e571e | 间接依赖 | go |
| github.com/golang/groupcache | v0.0.0-20210331224755-41bb18bfe9da | 间接依赖 | go |
| github.com/sasha-s/go-csync | v0.0.0-20210812194225-61421b77c44b | 间接依赖 | go |
| github.com/AlekSi/pointer | v1.2.0 | 间接依赖 | go |
| github.com/googleapis/gax-go/v2 | v2.6.0 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/credentials | v1.11.2 | 间接依赖 | go |
| github.com/ktr0731/go-shellstring | v0.1.3 | 直接依赖 | go |
| golang.org/x/sync | v0.1.0 | 直接依赖 | go |
| github.com/aws/aws-sdk-go-v2/feature/ec2/imds | v1.12.3 | 间接依赖 | go |
| github.com/mitchellh/go-homedir | v1.1.0 | 直接依赖 | go |
| github.com/emirpasic/gods | v1.12.0 | 间接依赖 | go |
| github.com/ProtonMail/go-crypto | v0.0.0-20211112122917-428f8eabeeb3 | 间接依赖 | go |
| github.com/cpuguy83/go-md2man/v2 | v2.0.2 | 间接依赖 | go |
| go.uber.org/goleak | v1.2.0 | 直接依赖 | go |
| gocloud.dev | v0.26.0 | 间接依赖 | go |
| go.uber.org/atomic | v1.9.0 | 间接依赖 | go |
| github.com/Azure/azure-sdk-for-go | v60.2.0+incompatible | 间接依赖 | go |
| github.com/improbable-eng/grpc-web | v0.14.1 | 间接依赖 | go |
| github.com/ulikunitz/xz | v0.5.10 | 间接依赖 | go |
| github.com/xanzy/go-gitlab | v0.73.1 | 间接依赖 | go |
| github.com/golang/protobuf | v1.5.2 | 直接依赖 | go |
| cloud.google.com/go/compute/metadata | v0.2.1 | 间接依赖 | go |
| cloud.google.com/go | v0.104.0 | 间接依赖 | go |
| github.com/hashicorp/go-retryablehttp | v0.7.1 | 间接依赖 | go |
| golang.org/x/oauth2 | v0.0.0-20221014153046-6fdb5e3db783 | 间接依赖 | go |
| github.com/disgoorg/log | v1.2.0 | 间接依赖 | go |
| github.com/muesli/termenv | v0.12.1-0.20220615005108-4e9068de9898 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/service/sts | v1.16.3 | 间接依赖 | go |
| golang.org/x/net | v0.10.0 | 间接依赖 | go |
| github.com/Masterminds/goutils | v1.1.1 | 间接依赖 | go |
| github.com/caarlos0/env/v6 | v6.10.0 | 间接依赖 | go |
| github.com/jmespath/go-jmespath | v0.4.0 | 间接依赖 | go |
| cloud.google.com/go/iam | v0.3.0 | 间接依赖 | go |
| google.golang.org/protobuf | v1.30.0 | 直接依赖 | go |
| github.com/rogpeppe/go-internal | v1.8.0 | 间接依赖 | go |
| gopkg.in/ini.v1 | v1.67.0 | 间接依赖 | go |
| github.com/Azure/go-autorest/autorest | v0.11.23 | 间接依赖 | go |
| cloud.google.com/go/storage | v1.23.0 | 间接依赖 | go |
| github.com/hashicorp/hcl | v1.0.0 | 间接依赖 | go |
| github.com/ktr0731/grpc-test | v0.1.10 | 直接依赖 | go |
| golang.org/x/tools | v0.6.0 | 直接依赖 | go |
| github.com/subosito/gotenv | v1.4.1 | 间接依赖 | go |
| golang.org/x/text | v0.9.0 | 间接依赖 | go |
| github.com/muesli/roff | v0.1.0 | 间接依赖 | go |
| cloud.google.com/go/kms | v1.4.0 | 间接依赖 | go |
| github.com/caarlos0/log | v0.1.2 | 间接依赖 | go |
| github.com/fatih/color | v1.13.0 | 直接依赖 | go |
| gopkg.in/yaml.v2 | v2.4.0 | 间接依赖 | go |
| github.com/muesli/mango-cobra | v1.2.0 | 间接依赖 | go |
| github.com/kisielk/godepgraph | v0.0.0-20190626013829-57a7e4a651a9 | 直接依赖 | go |
| github.com/disgoorg/disgo | v0.13.17 | 间接依赖 | go |
| github.com/Azure/go-autorest | v14.2.0+incompatible | 间接依赖 | go |
| nhooyr.io/websocket | v1.8.7 | 间接依赖 | go |
| github.com/mattn/go-isatty | v0.0.19 | 直接依赖 | go |
| github.com/Azure/go-autorest/logger | v0.2.1 | 间接依赖 | go |
| gopkg.in/alexcesaro/quotedprintable.v3 | v3.0.0-20150716171945-2caba252f4dc | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/feature/s3/manager | v1.11.3 | 间接依赖 | go |
| github.com/zchee/go-xdgbasedir | v1.0.3 | 直接依赖 | go |
| github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding | v1.9.1 | 间接依赖 | go |
| github.com/google/go-cmp | v0.5.9 | 直接依赖 | go |
| github.com/goreleaser/nfpm/v2 | v2.18.1 | 间接依赖 | go |
| github.com/dghubble/oauth1 | v0.7.1 | 间接依赖 | go |
| github.com/gobwas/glob | v0.2.3 | 间接依赖 | go |
| github.com/goreleaser/fileglob | v1.3.0 | 间接依赖 | go |
| github.com/Azure/go-autorest/autorest/adal | v0.9.18 | 间接依赖 | go |
| github.com/ktr0731/dept | v0.1.3 | 间接依赖 | go |
| golang.org/x/mod | v0.8.0 | 间接依赖 | go |
| github.com/muesli/mango | v0.1.0 | 间接依赖 | go |
| github.com/ktr0731/go-updater | v0.1.6 | 直接依赖 | go |
| github.com/huandu/xstrings | v1.3.2 | 间接依赖 | go |
| github.com/phayes/freeport | v0.0.0-20180830031419-95f893ade6f2 | 直接依赖 | go |
| github.com/inconshreveable/go-update | v0.0.0-20160112193335-8152e7eb6ccf | 间接依赖 | go |
| golang.org/x/time | v0.0.0-20220722155302-e5dcc9cfc0b9 | 间接依赖 | go |
| github.com/Masterminds/sprig | v2.22.0+incompatible | 间接依赖 | go |
| github.com/gin-gonic/gin | v1.9.1 | 间接依赖 | go |
| github.com/google/go-github | v17.0.0+incompatible | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/service/s3 | v1.26.3 | 间接依赖 | go |
| gitlab.com/digitalxero/go-conventional-commit | v1.0.7 | 间接依赖 | go |
| github.com/spf13/cast | v1.5.0 | 间接依赖 | go |
| github.com/mitchellh/reflectwalk | v1.0.2 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/internal/ini | v1.3.10 | 间接依赖 | go |
| github.com/k0kubun/colorstring | v0.0.0-20150214042306-9440f1994b88 | 间接依赖 | go |
| github.com/spf13/viper | v1.14.0 | 直接依赖 | go |
| github.com/go-telegram-bot-api/telegram-bot-api | v4.6.4+incompatible | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 | v2.4.3 | 间接依赖 | go |
| github.com/disgoorg/snowflake/v2 | v2.0.0 | 间接依赖 | go |
| github.com/Azure/azure-pipeline-go | v0.2.3 | 间接依赖 | go |
| github.com/muesli/reflow | v0.2.1-0.20210115123740-9e1d0d53df68 | 间接依赖 | go |
| github.com/hashicorp/errwrap | v1.0.0 | 间接依赖 | go |
| github.com/spf13/jwalterweatherman | v1.1.0 | 间接依赖 | go |
| gopkg.in/yaml.v3 | v3.0.1 | 间接依赖 | go |
| github.com/kevinburke/ssh_config | v1.1.0 | 间接依赖 | go |
| github.com/Azure/go-autorest/autorest/azure/cli | v0.4.4 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/service/internal/s3shared | v1.13.3 | 间接依赖 | go |
| github.com/cenkalti/backoff/v4 | v4.1.2 | 间接依赖 | go |
| github.com/ktr0731/go-prompt | v0.2.4 | 直接依赖 | go |
| github.com/rivo/uniseg | v0.2.0 | 间接依赖 | go |
| github.com/ktr0731/bump | v0.1.0 | 直接依赖 | go |
| github.com/goreleaser/chglog | v0.2.2 | 间接依赖 | go |
| github.com/manifoldco/promptui | v0.9.0 | 直接依赖 | go |
| google.golang.org/grpc | v1.51.0 | 直接依赖 | go |
| github.com/pelletier/go-toml/v2 | v2.0.8 | 间接依赖 | go |
| golang.org/x/xerrors | v0.0.0-20220907171357-04be3eba64a2 | 间接依赖 | go |
| github.com/mattn/go-tty | v0.0.3 | 间接依赖 | go |
| github.com/Azure/go-autorest/autorest/azure/auth | v0.5.10 | 间接依赖 | go |
| github.com/go-git/go-billy/v5 | v5.3.1 | 间接依赖 | go |
| go.opencensus.io | v0.23.0 | 间接依赖 | go |
| google.golang.org/genproto | v0.0.0-20221024183307-1bc688fe9f3e | 直接依赖 | go |
| github.com/withfig/autocomplete-tools/integrations/cobra | v1.2.1 | 间接依赖 | go |
| github.com/dimchansky/utfbom | v1.1.1 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/service/internal/checksum | v1.1.3 | 间接依赖 | go |
| github.com/google/uuid | v1.3.0 | 间接依赖 | go |
| github.com/aws/aws-sdk-go-v2/service/sso | v1.11.3 | 间接依赖 | go |
| github.com/Azure/go-autorest/autorest/date | v0.3.0 | 间接依赖 | go |
| github.com/Azure/azure-storage-blob-go | v0.14.0 | 间接依赖 | go |
| github.com/Masterminds/semver/v3 | v3.1.1 | 间接依赖 | go |
| github.com/gorilla/websocket | v1.5.0 | 间接依赖 | go |
| code.gitea.io/sdk/gitea | v0.15.1 | 间接依赖 | go |
| github.com/matryer/moq | v0.2.7 | 直接依赖 | go |
| github.com/spf13/cobra | v1.6.1 | 直接依赖 | go |
| github.com/olekukonko/tablewriter | v0.0.5 | 直接依赖 | go |
| github.com/hashicorp/go-cleanhttp | v0.5.2 | 间接依赖 | go |
| github.com/dghubble/sling | v1.4.0 | 间接依赖 | go |