upstream/packer
1
0
Fork 0
mirror of https://github.com/hashicorp/packer.git synced 2026-02-03 20:39:29 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

release: ignore AWS SDK vulnerability for release

Browse source 
The reported AWS S3 vulnerability was inherited from the go-getter
module that Packer uses for downloading files from external sources.

This vulnerability only impacts S3 uploads, therefore Packer is not
vulnerable itself as go-getter only downloads such blobs.

Since the change required to fix this advisory would be to bump the AWS
SDK to v2, this being a major change, is not something to do lightly, so
we opted to ignore this advisory for now so it doesn't block upcoming
releases.
This commit is contained in:
Lucas Bajolet 2025-01-06 14:40:12 -05:00 committed by Lucas Bajolet
parent 024bf7259a
commit 783d5113ba
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
.release/security-scan.hcl
View file

@ -13,4 +13,14 @@ binary {
osv = true
oss_index = true
nvd = false
# Triage items that are _safe_ to ignore here. Note that this list should be
# periodically cleaned up to remove items that are no longer found by the scanner.
triage {
suppress {
vulnerabilities = [
"GO-2022-0635", // github.com/aws/aws-sdk-go@v1.55.5 TODO(dduzgun-security): remove when deps is resolved
]
}
}
}