Open Stack

Hi Christophe,

Thanks for bringing this to our attention. You are right, we don’t expose any xml interface in Kata. The affected go package mentioned is "encoding/xml" and we do not vendor that in any of our Kata components. So, I don’t think we are impacted by the vulnerability.

Thanks,
Archana


On 12/15/20, 8:55 AM, "Christophe de Dinechin" <cdupontd at redhat.com> wrote:

    Hey Team,
    
    
    In case you have not seen it yet, a new vulnerability in how Go handles XML has just been disclosed:
    https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
    
    I suspect that we are indirectly impacted by this, although I have not read the disclosure in details yet. From a very cursory search in our code base, it looks like several vendored components may be directly hit. I don't see any immediate risk, in the sense that I don't think we expose any XML interface. But I may be wrong.
    
    What do you think?
    
    
    Thanks
    Christophe
    
    
    _______________________________________________
    kata-dev mailing list
    kata-dev at lists.katacontainers.io
    http://lists.katacontainers.io/cgi-bin/mailman/listinfo/kata-dev