bump golang.org/x/net to fix CVE-2022-41717

[fengshunli]

Signed-off-by: fsl 1171313930@qq.com

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

golang.org/x/net updates to v0.6.0 to fix CVE-2022-41717

[codecov-commenter]

Codecov Report

Merging #3048 (7776f96) into master (aa5868a) will increase coverage by 0.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #3048      +/-   ##
==========================================
+ Coverage   38.96%   38.98%   +0.01%     
==========================================
  Files         207      207              
  Lines       19365    19365              
==========================================
+ Hits         7546     7549       +3     
+ Misses      11362    11360       -2     
+ Partials      457      456       -1     

Flag	Coverage Δ
unittests	38.98% <ø> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/search/proxy/store/store.go	68.42% <0.00%> (+3.15%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[chaunceyjiang]

golang.org/x/net is too old and vulnerable to GO-2022-1144

Refer to #2718

[fengshunli]

golang.org/x/net is too old and vulnerable to GO-2022-1144

Refer to #2718

fixed

[RainbowMango]

Is there any evidence showing that Karmada is affected by the CVE?

[fengshunli]

Is there any evidence showing that Karmada is affected by the CVE?

There are vulnerabilities in images built based on source code

[RainbowMango]

There are vulnerabilities in images built based on source code

Could you please show the evidence in more detail?

If we are fixing a security issue, we probably need to release a warning as per vulnerability-handling-process

[fengshunli]

There are vulnerabilities in images built based on source code

Could you please show the evidence in more detail?

If we are fixing a security issue, we probably need to release a warning as per vulnerability-handling-process

before repair

after repair

[RainbowMango]

Interesting! Which tools you are using?

[fengshunli]

Interesting! Which tools you are using?

https://github.com/aquasecurity/trivy

[RainbowMango]

Thanks, it's very helpful and reminds us to setup the image scanning process.
/assign

[RainbowMango]

/lgtm
/approve

[karmada-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RainbowMango

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [RainbowMango]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[RainbowMango]

By the way, I added an agenda to this week's meeting to talk about how to integrate image scans into CI.