Security vulnerabilities introduced by supercronic

[mohammed-ezzedine]

Pre issue-raising checklist

I have already (please mark the applicable with an x):

• [ X ] Confirmed this is the right place to raise the issue - only issues related to the Dockerization of the Pact Broker should be raised here. Issues related to the Pact Broker application itself should be raised in the Pact Broker project.
• [ X ] Upgraded to the latest Pact Broker Docker image OR
• [ X ] Checked the CHANGELOG to see if the issue I am about to raise has been fixed
• [ X ] Read the Troubleshooting page

Software versions

• pact-broker docker version: 2.105.0.0

Expected behaviour

No security vulnerabilities in the image

Actual behaviour

Two security vulnerabilities found:
(CVE-2021-38297 and CVE-2022-23806)

Steps to reproduce

Version 2.105.0.0 of pact-broker uses supercronic with version v0.1.11 which introduces the above security vulnerabilities caused by using an old version of golang (1.14.4).

These vulnerabilities are fixed in golang version 1.17.7+ and are addressed in supercronic v0.2.0 so an upgrade for supercronic to v0.2.0+ would solve it.

[github-actions]

👋 Thanks, Jira [PACT-590] ticket created.

[github-actions]

👋 Thanks, Jira [PACT-599] ticket created.

[bethesque]

Released in tag 2.106.0.0