PRISMA-2023-0056 Reported from Twistlock

[dpericaxon]

Hello, we ran a twistlock scan and got this finding:

CVE: PRISMA-2023-0056
Image: hashicorp/consul:1.17.2
Description: The github.com/sirupsen/logrus module of all versions is vulnerable to denial of service. Logging more than 64kb of data in a single entry without newlines causes the log writer function to hang indefinitely.
Distro: alpine-3.18.5
Package: github.com/sirupsen/logrus v1.9.0
Package Path: /bin/consul
Info: sirupsen/logrus#1370

I think its coming from here: https://github.com/hashicorp/consul/blob/main/go.mod#L250

Are there plans to bump this dependency?

[sarah-oloumi]

Its been sometime and this is still being detected in v1.19.x of consul. I wanted to see if there are any updates on this?

[tian-ma]

The PR #21932 is not merged. I don't know who to contact to help push this