Skip to content

Commit d81bfa6

Browse files
authored
ci: ignore nancy failre of rs/cors@v1.8.2 (bnb-chain#3327)
It is an issue reported in rs/cors#170 and fixed by rs/cors#171, which was included in release v1.11.0(Apr 2024): https://github.com/rs/cors/releases/tag/v1.11.0 But v1.8.2 was released in Dec 2021, which may have a lot difference. And this vulnerability is limitted only to RPC nodes with maliciously configuration in config.tion: [Node] HTTPCors = ["<malicious cors>",...] So instead of upgrade to v1.11.0+, simply add it to nancy ignore for now
1 parent b91df1d commit d81bfa6

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

.nancy-ignore

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
CVE-2024-34478 # "CWE-754: Improper Check for Unusual or Exceptional Conditions." This vulnerability is BTC only, BSC does not have the issue.
2-
CVE-2021-43668 # "CWE-476: NULL Pointer Dereference", the repo: syndtr/goleveldb is not actively maintained, seems there is no fix for this crash yet, BSC used pebbleDB to replaced levelDB, so ignore this vulnerability.
2+
CVE-2021-43668 # "CWE-476: NULL Pointer Dereference", the repo: syndtr/goleveldb is not actively maintained, seems there is no fix for this crash yet, BSC used pebbleDB to replaced levelDB, so ignore this vulnerability.
3+
CVE-2025-47908 # "CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')", This vulnerability is only for RPC nodes which have specifically enabled malicous Cors options, which is unlikely to happen.

0 commit comments

Comments
 (0)