Golang vulnerability checker flags Go vulnerabilities

Govulncheck, a command-line instrument to assist customers of Google’s Go programming language discover recognized vulnerabilities in challenge dependencies, has reached 1.0.0 standing, the Go safety group mentioned.

Unveiled July 13, Govulncheck can analyze each binaries and supply code. It reduces noise by prioritizing vulnerabilities in features the code is looking. Govulncheck is powered by the Go vulnerability database, which supplies details about recognized vulnerabilities in public Go modules. Govulncheck makes use of static evaluation of supply code or a binary’s image desk to restrict its reviews to solely vulnerabilities that might have an effect on a specific software.

Builders can use go set up to put in the instrument:

go set up golang.org/x/vuln/cmd/govulncheck@newest

Builders can analyze supply code by operating Govulncheck inside a module listing:

govulncheck ./...

Govulncheck have to be constructed with Go 1.18 or a later model. Go 1.20 is the present manufacturing launch of the language.

Govulncheck searches for vulnerabilities utilizing a particular construct configuration. For supply code, the configuration is the Go model specified by the “go” command discovered on the trail. For binaries, the construct configuration is the one utilized in constructing the binary. Completely different construct configurations might have completely different recognized vulnerabilities.

Govulncheck has quite a lot of limitations:

• Govulncheck analyzes operate pointer and interface calls conservatively, which might lead to false positives or inaccurate name stacks.
• Calls to features made utilizing package deal replicate aren’t seen.
• As a result of Go binaries should not have detailed name data, Govulncheck can’t present name graphs for detected vulnerabilities. It additionally may report false positives for code that’s within the binary however not reachable.
• There isn’t a help for silencing vulnerability findings.
• For binaries the place image data can’t be extracted, Govulncheck reviews vulnerabilities for all modules on which the binary relies upon.

The Go safety group initially introduced help for vulnerability administration final September, with the challenge anchored by the vulnerability database.