CVE-2019-11840 worth investigating?

[tsatke]

https://ossindex.sonatype.org/vuln/5121f5ff-9831-44a6-af2e-24f7301d1df7

Detected by DepShield in gojisvm/gojis#61

Maybe this isn't worth investigating or incorrect in this case, but I would like some feedback on this :)

[rs]

What part of zerolog would be affected?

[tsatke]

There is a fix for this (golang/go#30965), but this fix was merged on March 21st, you are using a commit from March 8th.

Maybe updating your x/tools dependency to a newer version fixes this?

[tsatke]

I am not familiar with the library in depth, but I'm thinking wherever you are using the x/tools

[rs]

It’s used by the linter tool (should prob be excluded from go.mod, and it’s not using the crypto package).

[tsatke]

Forked it and tried it, tools is on latest commit actually (20190425)...
But I noticed you didn't commit a go.sum file, you should probably do that.

Alright, thanks for the feedback, feel free to close this issue, thanks for the incredibly fast response!

[tsatke]

Actually there is a new version... Opened a PR just now