Recommended update for govulncheck, govulncheck-vulndb

Announcement ID:	SUSE-RU-2024:3738-1
Release Date:	2024-10-21T10:41:23Z
Rating:	moderate
References:
Affected Products:	openSUSE Leap 15.5 openSUSE Leap 15.6 SUSE Linux Enterprise Desktop 15 SP5 SUSE Linux Enterprise Desktop 15 SP6 SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Real Time 15 SP5 SUSE Linux Enterprise Real Time 15 SP6 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP6 SUSE Package Hub 15 15-SP5 SUSE Package Hub 15 15-SP6

An update that can now be installed.

Description:

This update for govulncheck, govulncheck-vulndb fixes the following issues:

govulncheck is shipped in version 1.1.3:

• internal/openvex: update handler test
• LICENSE: update per Google Legal
• internal/vulncheck: add warning message for ancient binaries
• all: remove build restrictions requiring go1.18
• cmd/govulncheck: clarify unsafe/reflection limitations
• cmd/govulncheck: update docs for old Go binaries
• internal/openvex: omit vulns with no findings
• cmd/govulncheck/integration: adjust k8s expectations
• all: remove skipIfShort
• all: remove unnecessary test lines for staticcheck
• internal/vulncheck: avoid recomputing if module is known
• go.mod: update golang.org/x dependencies
• internal/buildinfo: add support for ancient Go binaries
• internal/goversion: comment out a printing line
• internal/goversion: add package as copy of rsc.io/goversion/version
• cmd/govulncheck: remove line about go version requirements
• internal/vulncheck: improve documentation
• internal/vulncheck: use module info when looking for symbols
• internal/vulncheck: handle symbols ending with .
• cmd/govulncheck/integration: make expectation check more robust
• all: require go1.21

Update to version 1.1.2:

• internal/osv: add review status
• vulncheck: update documentation for vex
• cmd/govulncheck/integration/stackrox-scanner: update expectations
• cmd/govulncheck/integration/k8s: update expectations
• internal/govulncheck: add more comments for emitted OSVs
• go.mod: update golang.org/x dependencies
• internal/scan: increase telemetry counter for show flag
• internal/scan: add format and scan level telemetry
• internal/cmd/govulncheck: remove unnecessary binary dependency
• cmd/govulncheck/integration: update go in integration tests
• internal/openvex: add hash for doc ID
• internal/openvex: add statements to handler
• internal/openvex: add handler
• all: remove test that runs govulncheck on govulncheck
• internal/sarif: fix a typo
• internal/scan: limit number of binary traces shown
• cmd/govulncheck: record scan mode telemetry

Update to version 1.1.1:

• all: remove unit tests for staticcheck, unparam, and spellcheck
• internal/sarif,cmd/govulncheck: publicize sarif
• internal/vulncheck: load source code for scan symbol mode only
• all: update golang.org/x/tools
• internal/vulncheck: emit progress message instead of warning
• internal/scan: improve textual output for binary traces
• internal/buildinfo: avoid panic on nil symbol for elf
• internal/sarif: improve GOMODCACHE relative paths
• internal/sarif: add version to module info for locations
• internal/sarif: remove originalURIBaseIds
• go.mod: update golang.org/x dependencies
• internal/gosym: preallocate inlined call slice
• internal/vulncheck: improve progress message for binaries
• internal/vulncheck: emit fetch db and vuln checking progress messages
• internal/scan: print progress messages only in verbose mode
• internal/scan: refactor flag usage in text handler
• Revert "internal/scan: disallow multiple patterns in source mode"
• internal/sarif: add missing required Message field
• internal/scan: disallow multiple patterns in source mode
• internal/vulncheck: use new improved DeleteSyntheticNodes

Update to version 1.1.0:

• internal/openvex: add vex types
• internal/sarif: compute relative paths for findings
• internal/sarif: remove unused field
• go.mod: update golang.org/x dependencies
• internal/sarif,internal/scan,internal/traces: clean up tests
• internal/sarif: add region part of the physical location
• internal/sarif: add code flows
• cmd/govulncheck: clean up test
• cmd/govulncheck: make test case config data
• cmd/govulncheck: add comment capability to fixups
• cmd/govulncheck: remove unnecessary fixups
• cmd/govulncheck: make fixup part of a test case
• cmd/govulncheck: extract stdlib into special test case
• cmd/govulncheck: restore parallelism for tests
• cmd/govulncheck: add nogomod test case
• cmd/govulncheck: restructure testdata tests
• cmd/govulncheck: add sarif test for binaries
• internal/sarif: add stacks
• internal/sarif: add result message
• internal/vulncheck: get correctly package for instantiated functions
• internal/sarif: add result stubs to run object
• internal/govulncheck: add scan mode to config
• internal/vulncheck: delete only synthetic nodes not related to generics
• internal/scan: add more info to validation errors
• internal/sarif: add rules
• internal/scan: fix name of the error variable
• internal/sarif: add handler
• internal/scan: add sarif flag
• internal/scan: add types for format, show, mode, and scan flags
• go.mod: update golang.org/x dependencies
• internal/vulncheck: use proper stdlib check when loading packages
• internal/vulncheck,internal/scan: sort messages where needed
• internal/scan: introduce format flag
• internal/vulncheck: manipulate packages from PackageGraph
• internal/vulncheck: do not have stdlibModule as global
• cmd/govulncheck: make sure filepath are cross-platform
• internal/govulncheck: fix up some comments
• internal/vulncheck: add relative paths for vendored paths
• internal/vulncheck: emit relative paths for call findings
• internal/vulncheck, internal/scan: improve stdlib reporting
• go.mod: update golang.org/x dependencies
• all: remove bash checks
• all: do go mod tidy test inside unit tests

Update to version 1.0.4:

• cmd/govulncheck: mask line numbers and columns
• internal/scan: remove redundant new lines
• internal/vulncheck: add position for sinks in findings' trace
• internal/scan: put -show <option> into single quotes
• internal/buildinfo: do module-level analysis with no PCLN table
• internal/scan: add a newline after summary
• internal/test: add more info on GoBuild failures
• internal/scan: remove extra dot in a comment
• cmd/govulncheck: fix vendor test
• internal/vulncheck: refactor a loop with an append
• cmd/govulncheck: fix stripped bin test
• cmd/govulncheck: update vendor tests
• cmd/govulncheck: add more tests and reorganize them
• internal/vulncheck: add package and module mode for binaries
• internal/scan: replace Source with Symbol in text output
• internal/scan: fix error statuses for scan={package|module}
• internal/scan: add -show verbose flag
• internal/scan: overhaul text output
• internal/scan: simplify redundant error checking
• internal/scan: add scan level to testdata
• cmd/govulncheck/integration: update expectations for stackrox
• internal/vulncheck: support osv entries with no pkg info
• internal/vulncheck: remove redundant symbol check
• internal/vulncheck: simplify vulnerability detection

Update to version 1.0.3:

• internal/scan: add binary extract mode
• internal/scan, vulncheck: use packages.load for mod info
• internal/govulncheck: briefly explain streaming JSON
• internal/vulncheck: remove -mod=mod flag from LoadModules

Update to version 1.0.2:

• cmd/govulncheck: update test data
• go.mod: update golang.org/x dependencies
• internal/osv: fix type name in comment
• internal/scan: remove informational header for package and module mode
• internal/scan: remove redundant newline for package and module mode
• cmd/govulncheck/integration/stackrox: update vuln expectation
• all: update tools to pick up bug fixes
• internal/vulncheck: compute proper db names for generic functions
• internal/vulncheck: improve error message for fetching vulns
• testdata: Add more package/mod level tests
• internal/scan: change text based on scan level
• internal/scan: update show help message
• internal/sarif: add sarif types
• internal/scan: enable module scan mode
• internal/scan: add scan_level to text tests
• internal/scan: add scan level to textHandler
• cmd/govulncheck: rearrange test files
• all: add logging to TestGovulncheck
• internal/scan: disallow package input in mod level
• go.mod: update golang.org/x dependencies
• cmd/govulncheck: fix mod level behavior
• all: update to x/tools@v.15.0
• internal/vulncheck: define Binary over Bin
• internal/vulncheck: add binary abstraction data structure
• cmd/govulncheck: organize tests into subdirs
• internal/scan: Improve "Informational" text output
• internal/scan: properly "genericify" choose
• internal/vulncheck: emit package findings all at once
• internal/vulncheck: update logic for package level analysis
• internal/vulncheck: remove obsolete tests and helpers
• internal/scan: remove obsolete function
• internal/scan: check for go mod before running
• cmd/govulncheck/integration: add new expectations
• cmd/govulncheck: Fix no go mod tests
• internal/vulncheck: rename moduleVulnerabilities
• internal/vulncheck: add documentation and propagate errors
• internal/vulncheck: emit OSVs in their raw form asap
• internal/scan: move emit logic for findings to internal/vulncheck
• internal: properly fetch modules in source mode
• internal/scan: verify scan level flag
• internal/govulncheck: update Finding docstring
• internal/vulncheck: remove file set computation
• internal/scan: generate better message when patterns matches no packages
• internal/scan, vulncheck: emit vulns as found
• internal/scan: use modVersion for mod version
• internal/scan: suggest earliest valid fixed version as the fix
• internal/scan: communicate default value for test flag
• internal/semver: rename the LatestFixedVersion function
• cmd/govulncheck: fix incorrect test file name
• cmd/govulncheck: remove go version for test file
• internal/vulnchec: improve comments and names for imports level logic
• internal/govulncheck: update description of Findings
• internal/vulncheck/internal/buildinfo: support stripped darwin binaries
• internal/scan: update test names
• internal/scan: text output allows module level vulns
• internal/client: add additional context to HTTP error message
• internal/scan: add isImported function
• internal/scan: fix trace count bug
• internal/vulncheck: add LoadModules using go.mod
• internal/govulncheck: add WantPackages scan level

Update to version 1.0.1:

• all: go get golang.org/x/tools@74c255b
• internal/scan: change the way convert mode works
• internal/scan: add -version flag
• internal/vulncheck/internal/gosym: fix typo
• internal/gosym: update binary mode version parsing
• internal/scan: refactor to remove redundant code
• vulncheck/internal/gosym: add support for go versions > 1.20
• internal/vulncheck/internal/buildinfo: skip failing tests
• cmd/govulncheck: skip TestCommand in short mode

Initial package version 1.0.0:

• internal/scan: print the summary even when there are no findings
• cmd,internal/govulncheck: change protocol version to v1.0.0
• cmd,internal: remove experimental reference
• internal/govulncheck: improve documentation

Changes in govulncheck-vulndb:

• Update to version 0.0.20241015T183857 date 2024-10-15T18:38:57Z.

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• openSUSE Leap 15.5
  zypper in -t patch openSUSE-SLE-15.5-2024-3738=1
• openSUSE Leap 15.6
  zypper in -t patch openSUSE-SLE-15.6-2024-3738=1
• SUSE Package Hub 15 15-SP5
  zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP5-2024-3738=1
• SUSE Package Hub 15 15-SP6
  zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2024-3738=1

Package List:

• openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)
  • govulncheck-1.1.3-150000.1.3.1
  • govulncheck-debuginfo-1.1.3-150000.1.3.1
• openSUSE Leap 15.5 (noarch)
  • govulncheck-vulndb-0.0.20241015T183857-150000.1.3.1
• openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
  • govulncheck-1.1.3-150000.1.3.1
  • govulncheck-debuginfo-1.1.3-150000.1.3.1
• openSUSE Leap 15.6 (noarch)
  • govulncheck-vulndb-0.0.20241015T183857-150000.1.3.1
• SUSE Package Hub 15 15-SP5 (aarch64 ppc64le s390x x86_64)
  • govulncheck-1.1.3-150000.1.3.1
  • govulncheck-debuginfo-1.1.3-150000.1.3.1
• SUSE Package Hub 15 15-SP5 (noarch)
  • govulncheck-vulndb-0.0.20241015T183857-150000.1.3.1
• SUSE Package Hub 15 15-SP6 (aarch64 ppc64le s390x x86_64)
  • govulncheck-1.1.3-150000.1.3.1
  • govulncheck-debuginfo-1.1.3-150000.1.3.1
• SUSE Package Hub 15 15-SP6 (noarch)
  • govulncheck-vulndb-0.0.20241015T183857-150000.1.3.1