Vulnerability report CVE-2022-1996 #309
Description
What happened?
just found K8S Go Client hit CVE report detected by gosec
Details about the CVE can be found here: https://avd.aquasec.com/nvd/cve-2022-1996
Libraries hit by gosec
k8s.io/client-go@v0.24.1 github.com/emicklei/go-restful@v2.9.5+incompatible
k8s.io/kube-openapi@v0.0.0-20220328201542-3ee0da9b0b42 github.com/emicklei/go-restful@v0.0.0-20170410110728-ff4f55a20633
What did you expect to happen?
gosec finished without error
How can we reproduce it (as minimally and precisely as possible)?
yes
Anything else we need to know?
No response
Kubernetes version
Client Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.2", GitCommit:"f66044f4361b9f1f96f0053dd46cb7dce5e990a8", GitTreeState:"clean", BuildDate:"2022-06-15T14:14:10Z", GoVersion:"go1.18.3", Compiler:"gc", Platform:"darwin/amd64"}
Kustomize Version: v4.5.4
Server Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.1", GitCommit:"3ddd0f45aa91e2f30c70734b175631bec5b5825a", GitTreeState:"clean", BuildDate:"2022-05-24T12:18:48Z", GoVersion:"go1.18.2", Compiler:"gc", Platform:"linux/amd64"}
Cloud provider
OS version
# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here
# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here