From 3720bd1f0359d44945ec5926f1c905c042d4ea43 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 26 Oct 2026 20:42:41 +0100 Subject: [PATCH] audits: R-972 govulncheck before/after (Go 1.27.3) --- .../after-felhom-agent.txt | 9 +++++++++ .../after-felhom-controller-controller.txt | 9 +++++++++ .../after-felhom.eu-hub.txt | 9 +++++++++ .../before-felhom-agent.txt | 16 ++++++++++++++++ .../before-felhom-controller-controller.txt | 16 ++++++++++++++++ .../before-felhom.eu-hub.txt | 16 ++++++++++++++++ 6 files changed, 75 insertions(+) create mode 100644 documentation/audits/r972-go1273-2026-10-26/after-felhom-agent.txt create mode 100644 documentation/audits/r972-go1273-2026-10-26/after-felhom-controller-controller.txt create mode 100644 documentation/audits/r972-go1273-2026-10-26/after-felhom.eu-hub.txt create mode 100644 documentation/audits/r972-go1273-2026-10-26/before-felhom-agent.txt create mode 100644 documentation/audits/r972-go1273-2026-10-26/before-felhom-controller-controller.txt create mode 100644 documentation/audits/r972-go1273-2026-10-26/before-felhom.eu-hub.txt diff --git a/documentation/audits/r972-go1273-2026-10-26/after-felhom-agent.txt b/documentation/audits/r972-go1273-2026-10-26/after-felhom-agent.txt new file mode 100644 index 00000000..d718f223 --- /dev/null +++ b/documentation/audits/r972-go1273-2026-10-26/after-felhom-agent.txt @@ -0,0 +1,9 @@ +=== Symbol Results === + +No vulnerabilities found. + +Your code is affected by 0 vulnerabilities. +This scan also found 0 vulnerabilities in packages you import and 1 +vulnerability in modules you require, but your code doesn't appear to call these +vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/r972-go1273-2026-10-26/after-felhom-controller-controller.txt b/documentation/audits/r972-go1273-2026-10-26/after-felhom-controller-controller.txt new file mode 100644 index 00000000..d718f223 --- /dev/null +++ b/documentation/audits/r972-go1273-2026-10-26/after-felhom-controller-controller.txt @@ -0,0 +1,9 @@ +=== Symbol Results === + +No vulnerabilities found. + +Your code is affected by 0 vulnerabilities. +This scan also found 0 vulnerabilities in packages you import and 1 +vulnerability in modules you require, but your code doesn't appear to call these +vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/r972-go1273-2026-10-26/after-felhom.eu-hub.txt b/documentation/audits/r972-go1273-2026-10-26/after-felhom.eu-hub.txt new file mode 100644 index 00000000..d718f223 --- /dev/null +++ b/documentation/audits/r972-go1273-2026-10-26/after-felhom.eu-hub.txt @@ -0,0 +1,9 @@ +=== Symbol Results === + +No vulnerabilities found. + +Your code is affected by 0 vulnerabilities. +This scan also found 0 vulnerabilities in packages you import and 1 +vulnerability in modules you require, but your code doesn't appear to call these +vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/r972-go1273-2026-10-26/before-felhom-agent.txt b/documentation/audits/r972-go1273-2026-10-26/before-felhom-agent.txt new file mode 100644 index 00000000..79c89ecc --- /dev/null +++ b/documentation/audits/r972-go1273-2026-10-26/before-felhom-agent.txt @@ -0,0 +1,16 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6809 + Distrust compromised intermediate certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-6809 + Standard library + Found in: crypto/x509@go1.27.2 + Fixed in: crypto/x509@go1.27.3 + Example traces found: + #1: internal/pbs/probe.go:42:33: pbs.ProbeFingerprint calls tls.Conn.HandshakeContext, which eventually calls x509.Certificate.Verify + +Your code is affected by 1 vulnerability from the Go standard library. +This scan also found 0 vulnerabilities in packages you import and 1 +vulnerability in modules you require, but your code doesn't appear to call these +vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/r972-go1273-2026-10-26/before-felhom-controller-controller.txt b/documentation/audits/r972-go1273-2026-10-26/before-felhom-controller-controller.txt new file mode 100644 index 00000000..96c1be58 --- /dev/null +++ b/documentation/audits/r972-go1273-2026-10-26/before-felhom-controller-controller.txt @@ -0,0 +1,16 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6809 + Distrust compromised intermediate certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-6809 + Standard library + Found in: crypto/x509@go1.27.2 + Fixed in: crypto/x509@go1.27.3 + Example traces found: + #1: internal/notify/notifier.go:1291:9: notify.Notifier.PushTestEventSync calls io.Copy, which eventually calls x509.Certificate.Verify + +Your code is affected by 1 vulnerability from the Go standard library. +This scan also found 0 vulnerabilities in packages you import and 1 +vulnerability in modules you require, but your code doesn't appear to call these +vulnerabilities. +Use '-show verbose' for more details. diff --git a/documentation/audits/r972-go1273-2026-10-26/before-felhom.eu-hub.txt b/documentation/audits/r972-go1273-2026-10-26/before-felhom.eu-hub.txt new file mode 100644 index 00000000..c64fa11b --- /dev/null +++ b/documentation/audits/r972-go1273-2026-10-26/before-felhom.eu-hub.txt @@ -0,0 +1,16 @@ +=== Symbol Results === + +Vulnerability #1: GO-2026-6809 + Distrust compromised intermediate certificates in crypto/x509 + More info: https://pkg.go.dev/vuln/GO-2026-6809 + Standard library + Found in: crypto/x509@go1.27.2 + Fixed in: crypto/x509@go1.27.3 + Example traces found: + #1: cmd/hub/main.go:215:15: hub.main calls fmt.Fprintf, which eventually calls x509.Certificate.Verify + +Your code is affected by 1 vulnerability from the Go standard library. +This scan also found 0 vulnerabilities in packages you import and 1 +vulnerability in modules you require, but your code doesn't appear to call these +vulnerabilities. +Use '-show verbose' for more details.