cloud-provider-vsphere/cpi/release/manager:v1.28.0 has HIGH vulnerability CVE-2023-44487

[mitchellmaler]

What happened?

Security tooling showing high cve CVE-2023-44487 on the release manager image for the latest version.

What did you expect to happen?

CVE to not exist.

How can we reproduce it (as minimally and precisely as possible)?

N/A

Anything else we need to know (please consider providing level 4 or above logs of CPI)?

This will require upgrading Golang to a later patch version to then pull in a newer version of the net package.

Kubernetes version

N/A

Cloud provider or hardware configuration

N/A

OS version

N/A

Kernel (e.g. uname -a)

N/A

Install tools

N/A

Container runtime (CRI) and and version (if applicable)

N/A

Related plugins (CNI, CSI, ...) and versions (if applicable)

N/A

Others

N/A

[mitchellmaler]

[YanzhaoLi]

/assign

[YanzhaoLi]

Bumping golang.org/x/net to 0.17.0 should fix this CVE, see https://github.com/golang/net/releases/tag/v0.17.0 and GHSA-qppj-fm5r-hxr3