Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: check mode compatibility #352

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

feat: check mode compatibility #352

wants to merge 2 commits into from

Conversation

artis3n
Copy link
Owner

@artis3n artis3n commented Jun 23, 2023

Working on implementation for #348

@artis3n artis3n temporarily deployed to E2E June 23, 2023 23:34 — with GitHub Actions Inactive
@artis3n artis3n temporarily deployed to E2E June 23, 2023 23:34 — with GitHub Actions Inactive
@artis3n artis3n temporarily deployed to E2E June 23, 2023 23:34 — with GitHub Actions Inactive
@artis3n artis3n temporarily deployed to E2E June 23, 2023 23:34 — with GitHub Actions Inactive
@artis3n artis3n temporarily deployed to E2E June 23, 2023 23:34 — with GitHub Actions Inactive
The `tailscale status --json` is purely gathering data (doesn't change anything), so it's ok to run this in check mode.
@semgrep-code-artis3n
Copy link

Semgrep found 1 ssc-f81fb526-8a62-4b49-a50c-82e2e14c7a87 finding:

Risk: certifi versions >= 2015.04.28 before 2023.07.22 are vulnerable to Insufficient Verification Of Data Authenticity. These versions use E-Tugra as a Certificate Authority, which is not recommended due to critical security vulnerabilities, such as the usage of default credentials in administrative tools, re-issuance of certificates without proper validation, and unauthorized access to sensitive information.

Fix: Upgrade this library to at least version 2023.7.22 at ansible-role-tailscale/poetry.lock:191.

Reference(s): GHSA-xqr8-7jwr-rhp7, CVE-2023-37920

Ignore this finding from ssc-f81fb526-8a62-4b49-a50c-82e2e14c7a87.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants