Audit Open Original ↗
Linkerd
Type
Security review
Client
Linux Foundation
Date
2022-02
Domain
Supply Chain
Effort
4 wks
Section
Cloud-Native Reviews
Trail of Bits's security review of The Linux Foundation (Feb 2022) identified 9 issues: 3 low, 4 informational, and 2 undetermined.
Findings · 9
- 1 Various unhandled errors Undetermined
- 2 The use of time.After() in select statements can lead to memory leaks Low
- 3 Use of string.Contains instead of string.HasPrefix to check for prefixes Undetermined
- 4 Risk of resource exhaustion due to the use of defer inside a loop Informational
- 5 Lack of maximum request and response body constraint Informational
- 6 Potential goroutine leak in Kubernetes port-forwarding initialization logic Informational
- 7 Risk of log injection in TAP service API Low
- 8 TLS configuration does not enforce minimum TLS version Low
- 9 Nil dereferences in the webhook server Informational
Findings extracted from the published report PDF. See the full report below for details and remediation.
Related
