Code Monkey home page Code Monkey logo

benchmark-matrix's People

Contributors

robholland avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar

Forkers

cwinters8 hades32 sean-sekora

benchmark-matrix's Issues

[Feature Request] Point Pulumi to Localstack for dev testing

Is your feature request related to a problem? Please describe.

Not really a problem, just maybe would be nice for contributing without costing $$$ in cloud costs

Describe the solution you'd like

Localstack has a CLI tool that wraps the Pulumi CLI. I would like to test if this works for the sake of future contributions, and if it does, I'll open a PR here to add docs (in README.md or elsewhere) on how to implement.

Additional context

For clarity, there's no expectation of actioning this from the temporal team - this is more of a "fyi I'm gonna try this and get back to you" 😁

If this works, another idea might be to add a Gitpod button/link for immediate environment spin up. There was just an article yesterday on integrating Localstack + Gitpod for improved/more efficient dx

pulumi-3.43.1.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - pulumi-3.43.1.tgz

Path to dependency file: /stacks/package.json

Path to vulnerable library: /stacks/package.json,/environments/aws/package.json

Found in HEAD commit: 4a36e97a0a6aa86c910cdb024048c18855f6c0d0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (pulumi version) Remediation Possible**
CVE-2022-25883 High 7.5 semver-6.3.0.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25883

Vulnerable Library - semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Path to dependency file: /stacks/package.json

Path to vulnerable library: /stacks/package.json,/environments/aws/package.json

Dependency Hierarchy:

  • pulumi-3.43.1.tgz (Root Library)
    • ❌ semver-6.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 4a36e97a0a6aa86c910cdb024048c18855f6c0d0

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

Tune eks-rds-postgres-m6i-large benchmark

Adjust the configuration to get the best throughput we can from the cluster. Document the process/outcomes so it can be applied as a starting point for other clusters.

aws-5.18.0.tgz: 1 vulnerabilities (highest severity is: 5.3) - autoclosed

Vulnerable Library - aws-5.18.0.tgz

Path to dependency file: /stacks/package.json

Path to vulnerable library: /stacks/node_modules/xml2js/package.json,/environments/aws/node_modules/xml2js/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (aws version) Remediation Available
CVE-2023-0842 Medium 5.3 xml2js-0.4.19.tgz Transitive 5.19.0 ✅

Details

CVE-2023-0842

Vulnerable Library - xml2js-0.4.19.tgz

Simple XML to JavaScript object converter.

Library home page: https://registry.npmjs.org/xml2js/-/xml2js-0.4.19.tgz

Path to dependency file: /stacks/package.json

Path to vulnerable library: /stacks/node_modules/xml2js/package.json,/environments/aws/node_modules/xml2js/package.json

Dependency Hierarchy:

  • aws-5.18.0.tgz (Root Library)
    • aws-sdk-2.1237.0.tgz
      • ❌ xml2js-0.4.19.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Publish Date: 2023-04-05

URL: CVE-2023-0842

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-0842

Release Date: 2023-04-05

Fix Resolution (xml2js): 0.5.0

Direct dependency fix Resolution (@pulumi/aws): 5.19.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

awsx-0.40.1.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - awsx-0.40.1.tgz

Path to dependency file: /environments/aws/package.json

Path to vulnerable library: /stacks/package.json,/environments/aws/package.json

Found in HEAD commit: 4a36e97a0a6aa86c910cdb024048c18855f6c0d0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (awsx version) Remediation Possible**
CVE-2022-25883 High 7.5 semver-5.7.1.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25883

Vulnerable Library - semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /stacks/package.json

Path to vulnerable library: /stacks/package.json,/environments/aws/package.json

Dependency Hierarchy:

  • awsx-0.40.1.tgz (Root Library)
    • docker-3.4.1.tgz
      • ❌ semver-5.7.1.tgz (Vulnerable Library)

Found in HEAD commit: 4a36e97a0a6aa86c910cdb024048c18855f6c0d0

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

eks-0.42.5.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - eks-0.42.5.tgz

Path to dependency file: /stacks/package.json

Path to vulnerable library: /environments/aws/package.json,/stacks/package.json

Found in HEAD commit: 4a36e97a0a6aa86c910cdb024048c18855f6c0d0

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (eks version) Remediation Possible**
CVE-2022-25883 High 7.5 semver-7.3.8.tgz Transitive N/A* ❌
CVE-2023-45857 Medium 6.5 axios-0.21.4.tgz Transitive 1.0.1 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25883

Vulnerable Library - semver-7.3.8.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.8.tgz

Path to dependency file: /environments/aws/package.json

Path to vulnerable library: /environments/aws/package.json,/stacks/package.json

Dependency Hierarchy:

  • eks-0.42.5.tgz (Root Library)
    • ❌ semver-7.3.8.tgz (Vulnerable Library)

Found in HEAD commit: 4a36e97a0a6aa86c910cdb024048c18855f6c0d0

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

CVE-2023-45857

Vulnerable Library - axios-0.21.4.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz

Path to dependency file: /environments/aws/package.json

Path to vulnerable library: /environments/aws/package.json,/stacks/package.json

Dependency Hierarchy:

  • eks-0.42.5.tgz (Root Library)
    • ❌ axios-0.21.4.tgz (Vulnerable Library)

Found in HEAD commit: 4a36e97a0a6aa86c910cdb024048c18855f6c0d0

Found in base branch: main

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution (axios): 1.6.0

Direct dependency fix Resolution (@pulumi/eks): 1.0.1

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

github.com/pulumi/pulumi/sdk/v3-v3.35.3: 5 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - github.com/pulumi/pulumi/sdk/v3-v3.35.3

Found in HEAD commit: bccaced53dc6517f5cb6cadfd832eee1d6762dc6

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (github.com/pulumi/pulumi/sdk/v3-v3.35.3 version) Remediation Available
CVE-2019-0205 High 7.5 github.com/uber/jaeger-client-go-v2.22.1+incompatible Transitive N/A* ❌
CVE-2022-27664 High 7.5 golang.org/x/net-v0.0.0-20220225172249-27dd8689420f Transitive N/A* ❌
CVE-2022-30633 High 7.5 golang.org/x/net-v0.0.0-20220225172249-27dd8689420f Transitive N/A* ❌
CVE-2022-32149 High 7.5 golang.org/x/text-v0.3.7 Transitive N/A* ❌
CVE-2022-28131 High 7.5 golang.org/x/net-v0.0.0-20220225172249-27dd8689420f Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2019-0205

Vulnerable Library - github.com/uber/jaeger-client-go-v2.22.1+incompatible

Jaeger Bindings for Go OpenTracing API.

Library home page: https://proxy.golang.org/github.com/uber/jaeger-client-go/@v/v2.22.1+incompatible.zip

Dependency Hierarchy:

  • github.com/pulumi/pulumi/sdk/v3-v3.35.3 (Root Library)
    • ❌ github.com/uber/jaeger-client-go-v2.22.1+incompatible (Vulnerable Library)

Found in HEAD commit: bccaced53dc6517f5cb6cadfd832eee1d6762dc6

Found in base branch: main

Vulnerability Details

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.

Publish Date: Oct 29, 2019 7:15:00 PM

URL: CVE-2019-0205

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0205

Release Date: Oct 29, 2019 7:15:00 PM

Fix Resolution: org.apache.thrift:libthrift:0.13.0

CVE-2022-27664

Vulnerable Library - golang.org/x/net-v0.0.0-20220225172249-27dd8689420f

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.0.0-20220225172249-27dd8689420f.zip

Dependency Hierarchy:

  • github.com/pulumi/pulumi/sdk/v3-v3.35.3 (Root Library)
    • ❌ golang.org/x/net-v0.0.0-20220225172249-27dd8689420f (Vulnerable Library)

Found in HEAD commit: bccaced53dc6517f5cb6cadfd832eee1d6762dc6

Found in base branch: main

Vulnerability Details

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Publish Date: Sep 6, 2022 6:15:00 PM

URL: CVE-2022-27664

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2022-30633

Vulnerable Library - golang.org/x/net-v0.0.0-20220225172249-27dd8689420f

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.0.0-20220225172249-27dd8689420f.zip

Dependency Hierarchy:

  • github.com/pulumi/pulumi/sdk/v3-v3.35.3 (Root Library)
    • ❌ golang.org/x/net-v0.0.0-20220225172249-27dd8689420f (Vulnerable Library)

Found in HEAD commit: bccaced53dc6517f5cb6cadfd832eee1d6762dc6

Found in base branch: main

Vulnerability Details

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

Publish Date: Aug 10, 2022 8:15:00 PM

URL: CVE-2022-30633

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2022-30633

Release Date: May 13, 2022 3:10:10 PM

Fix Resolution: go1.17.12,go1.18.4

CVE-2022-32149

Vulnerable Library - golang.org/x/text-v0.3.7

Library home page: https://proxy.golang.org/golang.org/x/text/@v/v0.3.7.zip

Dependency Hierarchy:

  • github.com/pulumi/pulumi/sdk/v3-v3.35.3 (Root Library)
    • golang.org/x/net-v0.0.0-20220225172249-27dd8689420f
      • ❌ golang.org/x/text-v0.3.7 (Vulnerable Library)

Found in HEAD commit: bccaced53dc6517f5cb6cadfd832eee1d6762dc6

Found in base branch: main

Vulnerability Details

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

Publish Date: Oct 14, 2022 3:15:00 PM

URL: CVE-2022-32149

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-32149

Release Date: Oct 14, 2022 3:15:00 PM

Fix Resolution: v0.3.8

CVE-2022-28131

Vulnerable Library - golang.org/x/net-v0.0.0-20220225172249-27dd8689420f

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.0.0-20220225172249-27dd8689420f.zip

Dependency Hierarchy:

  • github.com/pulumi/pulumi/sdk/v3-v3.35.3 (Root Library)
    • ❌ golang.org/x/net-v0.0.0-20220225172249-27dd8689420f (Vulnerable Library)

Found in HEAD commit: bccaced53dc6517f5cb6cadfd832eee1d6762dc6

Found in base branch: main

Vulnerability Details

In Decoder.Skip in encoding/xml in Go before 1.17.12 and 1.18.x before 1.18.4, stack exhaustion and a panic can occur via a deeply nested XML document.

Publish Date: Aug 10, 2022 8:15:00 PM

URL: CVE-2022-28131

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2022-28131

Release Date: Mar 29, 2022 3:10:07 PM

Fix Resolution: go1.17.12,go1.18.4

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.