-
Notifications
You must be signed in to change notification settings - Fork 65
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Libexpat before 2.4.5 contains a CVE #76
Comments
I'd like to add that the scanner noted the vulnerability in the code used by our group as well (and I assume Ed's issue came up from the same scanner) with the following suggested fix: Upgrade to version: cmake - 3.19.5,3.17.3,3.22.0;cmake-native - 3.22.0,3.17.3,3.20.1;python3 - 3.8.2. So at least part of the issue may simply be related to a build rather than the code. Is it possible to rerun the build using the minimum component version indicated, by any chance? |
The "Mend" tool complains about a CVE in the embedded version of Expat. Consider replacing the current Expat source with newer version.
The claim is that
Here is Expat's fix of the issue
Go-graphviz is using this version
Related: #42 (comment)
The text was updated successfully, but these errors were encountered: