gogo protobuf CVE-2021-3121 (< 1.3.2)

[sergiodj]

The gogo protobuf module in the version that is being used by telegraf (1.3.1) has a CVE:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121

The vulnerability has been fixed in version 1.3.2. Please consider bumping the version of this dependency. Thanks!

[helenosheaa]

Thanks for opening this issue, I'll look into upgrading the dependency!

[sergiodj]

Thanks @helenosheaa!

[Emeka-MSFT]

@helenosheaa , the go.sum file contains references to the older protobuf versions.

Does this mean that Telegraf depends on components that required/use the older/vulnerable versions?

If this is correct, then would these Telegraf dependencies need to be updated as well?

[Emeka-MSFT]

Opened #10581