Program: CWE-862
Project: CVE-2021-21432
Buggy source:
module github.com/go-vela/server

go 1.15

require (
	github.com/Masterminds/semver/v3 v3.1.1
	github.com/aws/aws-sdk-go v1.36.32
	github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73 // indirect
	github.com/dgrijalva/jwt-go v3.2.0+incompatible
	github.com/fatih/color v1.10.0 // indirect
	github.com/frankban/quicktest v1.7.2 // indirect
	github.com/gin-gonic/gin v1.6.3
	github.com/go-playground/assert/v2 v2.0.1
	github.com/go-redis/redis v6.15.9+incompatible
	github.com/go-vela/compiler v0.7.4
	github.com/go-vela/types v0.7.4
	github.com/google/go-cmp v0.5.4
	github.com/google/go-github/v29 v29.0.3
	github.com/google/gofuzz v1.2.0 // indirect
	github.com/google/uuid v1.2.0
	github.com/hashicorp/go-hclog v0.10.0 // indirect
	github.com/hashicorp/go-multierror v1.1.0 // indirect
	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
	github.com/hashicorp/vault/api v1.0.4
	github.com/jinzhu/gorm v1.9.16
	github.com/jinzhu/now v1.1.1 // indirect
	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
	github.com/mitchellh/mapstructure v1.3.2 // indirect
	github.com/onsi/ginkgo v1.14.2 // indirect
	github.com/onsi/gomega v1.10.4 // indirect
	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
	github.com/pkg/errors v0.9.1
	github.com/prometheus/client_golang v1.9.0
	github.com/sirupsen/logrus v1.8.0
	github.com/urfave/cli/v2 v2.3.0
	golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93
	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
	gopkg.in/tomb.v2 v2.0.0-20161208151619-d5d1b5820637
)


Fixed version (ground truth):
module github.com/go-vela/server

go 1.15

require (
	github.com/Masterminds/semver/v3 v3.1.1
	github.com/aws/aws-sdk-go v1.36.32
	github.com/denisenkom/go-mssqldb v0.0.0-20191128021309-1d7a30a10f73 // indirect
	github.com/dgrijalva/jwt-go v3.2.0+incompatible
	github.com/fatih/color v1.10.0 // indirect
	github.com/frankban/quicktest v1.7.2 // indirect
	github.com/gin-gonic/gin v1.6.3
	github.com/go-playground/assert/v2 v2.0.1
	github.com/go-redis/redis v6.15.9+incompatible
	github.com/go-vela/compiler v0.7.4
	github.com/go-vela/types v0.7.4
	github.com/google/go-cmp v0.5.4
	github.com/google/go-github/v29 v29.0.3
	github.com/google/go-github/v33 v33.0.0
	github.com/google/gofuzz v1.2.0 // indirect
	github.com/google/uuid v1.2.0
	github.com/hashicorp/go-hclog v0.10.0 // indirect
	github.com/hashicorp/go-multierror v1.1.0 // indirect
	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
	github.com/hashicorp/vault/api v1.0.4
	github.com/jinzhu/gorm v1.9.16
	github.com/jinzhu/now v1.1.1 // indirect
	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
	github.com/mitchellh/mapstructure v1.3.2 // indirect
	github.com/onsi/ginkgo v1.14.2 // indirect
	github.com/onsi/gomega v1.10.4 // indirect
	github.com/pierrec/lz4 v2.5.2+incompatible // indirect
	github.com/pkg/errors v0.9.1
	github.com/prometheus/client_golang v1.9.0
	github.com/sirupsen/logrus v1.8.0
	github.com/urfave/cli/v2 v2.3.0
	golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93
	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e // indirect
	gopkg.in/square/go-jose.v2 v2.5.1 // indirect
	gopkg.in/tomb.v2 v2.0.0-20161208151619-d5d1b5820637
)