[Feature Request] CVE - Bump rcon-cli, supercronic and gosu

[jammsen]

Have you read the Important information text above

• Yes i did

Describe the feature

CVE - Bump rcon-cli, supercronic and gosu

Additional information

• Would you be willing to help implement this feature?

Final checks

• I understand that this is a feature request function. I also understand that if i use this to report a bug report, that my issue might be un-answered closed.

[GlitchApotamus]

gosu and rcon-cli are both still up to date

[jammsen]

Yeah sadly i researched this yesterday and i agree its true 😭 - I know that basically all of the tools are in a seperate layer and cant even been accessed from the outside, so basically its kinda safe. (Most of them is stdlib in Go) But i wanted to wish for a Docker-Hub CVE report thats not looking like a brightly-shining Chrismas-Tree in Red to Yellow:

[GlitchApotamus]

How do we fix stdlib problems?

[jammsen]

Most of the time its an upgrade to the latest version. Purely based one a CVE perspective. There is also most of the time a tool that checks code-coverage and figure out IF you even use the part in your code, that is in danger of the CVE named. Happends quite a lot to Golang tools. Also stdlib has like always an high-to-insane amount of CVEs.

So im guessing the only way to even try to solve this, is download source tar.gz use sed and replace old value with new value AND then HOPE it still works 🤣 - Aside from just regularly run the shell-script that some of the maintainers provide - See: https://github.com/tianon/gosu/blob/master/govulncheck-with-excludes.sh

[jammsen]

Supercronic is awesome that way:
https://github.com/aptible/supercronic/releases
https://github.com/aptible/supercronic?tab=security-ov-file#readme

Gosu did work to create something to cover this and rcon-cli is just silence since years:
gorcon/rcon-cli#39

[GlitchApotamus]

Gosu did work to create something to cover this and rcon-cli is just silence since years:

Maybe we can wait a bit longer for Gosu to see if they can produce it. We could move around rcon and switch to the rest api since, (last I heard at least), Pocketpair will deprecate the rcon at some point anyways.

So im guessing the only way to even try to solve this, is download source tar.gz use sed and replace old value with new value

How do I know what values to replace with what exactly? I've never actually touched Go

[jammsen]

Gosu did work to create something to cover this and rcon-cli is just silence since years:

Maybe we can wait a bit longer for Gosu to see if they can produce it. We could move around rcon and switch to the rest api since, (last I heard at least), Pocketpair will deprecate the rcon at some point anyways.

Source to deprecation? ( The rcon tool is the most modern and best to use, while beeing unmaintained 😿 )

So im guessing the only way to even try to solve this, is download source tar.gz use sed and replace old value with new value

How do I know what values to replace with what exactly? I've never actually touched Go

Well the dependencies in the CVE would be a good start. But i really unsure about this. The Shellscript returns nothing, so the CVEs Docker Hub returns are all false postives according to that script.

[GlitchApotamus]

https://docs.palworldgame.com/api/rcon/

[jammsen]

Hmmmm, it says deprecated yeah, not sure if they act like Atlassian or so, that after like a few releases "deprecation" means "removal".

https://docs.palworldgame.com/api/rcon/