Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bump to go 1.22.7 #82

Merged
merged 1 commit into from
Sep 10, 2024
Merged

bump to go 1.22.7 #82

merged 1 commit into from
Sep 10, 2024

Conversation

Tankilevitch
Copy link
Contributor

@Tankilevitch Tankilevitch commented Sep 10, 2024

Description

What - Bump golang version to 1.22.7
Why - Resolve vulnerabilities

docker scout cves ghcr.io/port-labs/port-k8s-exporter:0.4.1
    i New version 1.13.0 available (installed version is 1.2.0) at https://github.com/docker/scout-cli
    ✓ SBOM of image already cached, 66 packages indexed
    ✗ Detected 2 vulnerable packages with a total of 8 vulnerabilities


## Overview

                    │               Analyzed Image
────────────────────┼──────────────────────────────────────────────
  Target            │  ghcr.io/port-labs/port-k8s-exporter:0.4.1
    digest          │  53d1a8e938bf
    platform        │ linux/arm64
    vulnerabilities │    1C     4H     2M     0L     1?
    size            │ 30 MB
    packages        │ 66


## Packages and Vulnerabilities

   1C     4H     1M     0L     1?  stdlib 1.22.3
pkg:golang/[email protected]

    ✗ CRITICAL CVE-2024-24790
      https://scout.docker.com/v/CVE-2024-24790?s=golang&n=stdlib&t=golang&vr=%3E%3D1.22.0-0%2C%3C1.22.4
      Affected range : >=1.22.0-0
                     : <1.22.4
      Fixed version  : 1.22.4

    ✗ HIGH CVE-2024-34158
      https://scout.docker.com/v/CVE-2024-34158?s=golang&n=stdlib&t=golang&vr=%3C1.22.7
      Affected range : <1.22.7
      Fixed version  : 1.22.7

    ✗ HIGH CVE-2024-34156
      https://scout.docker.com/v/CVE-2024-34156?s=golang&n=stdlib&t=golang&vr=%3C1.22.7
      Affected range : <1.22.7
      Fixed version  : 1.22.7

    ✗ HIGH CVE-2024-24791
      https://scout.docker.com/v/CVE-2024-24791?s=golang&n=stdlib&t=golang&vr=%3E%3D1.22.0-0%2C%3C1.22.5
      Affected range : >=1.22.0-0
                     : <1.22.5
      Fixed version  : 1.22.5

    ✗ HIGH CVE-2022-30635
      https://scout.docker.com/v/CVE-2022-30635?s=golang&n=stdlib&t=golang&vr=%3C1.22.7
      Affected range : <1.22.7
      Fixed version  : 1.22.7

    ✗ MEDIUM CVE-2024-24789
      https://scout.docker.com/v/CVE-2024-24789?s=golang&n=stdlib&t=golang&vr=%3E%3D1.22.0-0%2C%3C1.22.4
      Affected range : >=1.22.0-0
                     : <1.22.4
      Fixed version  : 1.22.4

    ✗ UNSPECIFIED CVE-2024-34155
      https://scout.docker.com/v/CVE-2024-34155?s=golang&n=stdlib&t=golang&vr=%3C1.22.7
      Affected range : <1.22.7
      Fixed version  : 1.22.7


   0C     0H     1M     0L  github.com/go-resty/resty/v2 2.7.0
pkg:golang/github.com/go-resty/resty/[email protected]

    ✗ MEDIUM CVE-2023-45286 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities]
      https://scout.docker.com/v/CVE-2023-45286?s=gitlab&n=v2&ns=github.com%2Fgo-resty%2Fresty&t=golang&vr=%3C%3Dv2.10.0
      Affected range : <=v2.10.0
      Fixed version  : not fixed
      CVSS Score     : 5.9
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N



8 vulnerabilities found in 2 packages
  UNSPECIFIED  1
  LOW          0
  MEDIUM       2
  HIGH         4
  CRITICAL     1

How -

Type of change

Please leave one option from the following and delete the rest:

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Non-breaking change (fix of existing functionality that will not change current behavior)
  • Documentation (added/updated documentation)

Copy link
Member

@erikzaadi erikzaadi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Tankilevitch Tankilevitch merged commit a549706 into main Sep 10, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants