You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
There are some vulnerabilities in gVisor. We need to either get rid of our wireguard-go fork and use some upstream commit that has taken the gVisor patched version, or directly upgrade our gVisor version.
The text was updated successfully, but these errors were encountered:
I'm looking into this in earnest, and coder/coder and our wireguard-go fork are already on gVisor release-20240506.0-27, which is newer than when those vulnerabilities reported in the email. (dates/SHA are different because we use the go branch rather than the main one that only builds with bazel).
I believe the tool that the person who reported it to us used is just wrong about these, possibly getting confused by the fact that we don't point to "official" version tags and instead point to "unofficial" go branch commits that are auto-updated to track the offical tags.
There are some vulnerabilities in gVisor. We need to either get rid of our wireguard-go fork and use some upstream commit that has taken the gVisor patched version, or directly upgrade our gVisor version.
The text was updated successfully, but these errors were encountered: