Problem

Currently, containerd/continuity directly imports the spf13/cobra v1.0.0 package in the go.mod file. The spf13/cobra v1.0.0 package imports spf13/viper v1.4.0 which imports coreos/etcd v3.3.10+incompatible. This is a problem because coreos/etcd v3.3.10+incompatible has a known security vulnerability with authentication when RBAC is used and client-cert-auth is enabled.

More information about the coreos/etcd security issue can be found here: https://nvd.nist.gov/vuln/detail/CVE-2018-16886

spf13/viper v1.4.0 also imports gorilla/websocket v1.4.0 which has a security vulnerability that allows for a potential DoS attack.

More information about the gorilla/websocket security issue can be found here: https://nvd.nist.gov/vuln/detail/CVE-2020-27813

Fix

1. The easiest fix is to upgrade the dependency on spf13/cobra to v1.4.0 as this version removes the dependency on viper entirely, and therefore removes the dependency on coreos/etcd and gorilla/websocket.
2. If it is not possible to upgrade spf13/cobra to v1.4.0, any version of spf13/cobra v1.2.0-v1.3.0 will import versions of coreos/etcd and gorilla/websocket that are safe to use, as of now.

Update

It appears as though PR #194 bumps spf13/cobra to v1.3.0 which would solve this issue should it get merged.