Twistlock scans reporting CVE #16232
Assignees
Labels
impact/security
kind/bug
Some behavior is incorrect or out of spec
resolution/fixed
This issue was fixed
Milestone
Comments
automagic
added
kind/bug
justinvp
added
impact/security
and removed
needs-triage
|
The next release of Pulumi will be built with Go 1.22.3, which will address https://pkg.go.dev/vuln/GO-2024-2824. Investigating upgrading go-jose. |
|
#16239 upgrades go-jose to a patched version. |
github-merge-queue bot
pushed a commit
that referenced
this issue
May 21, 2024
Upgrade `gocloud.dev/secrets/hashivault` to the latest version, `v0.37.0`, which also matches the `gocloud.dev` version we depend on. This replaces the indirect dependency on `gopkg.in/square/go-jose.v2` `v2.6.0`, which has a vulnerability (see https://pkg.go.dev/vuln/GO-2024-2631), with v3.0.3, which addresses the vulnerability. Part of #16232
|
This has been addressed with the release of v3.117.0, which is rolling out now. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What happened?
Twistlock scans of our container images that contain Pulumi CLI started to report following vulnerabilities: GO-2024-2824( https://pkg.go.dev/vuln/GO-2024-2824 ) and GO-2024-2631( https://pkg.go.dev/vuln/GO-2024-2631 ) . We rebuild our base images daily with latest .NET base images and latest Pulumi CLI
Example
Output of
pulumi aboutCLI
Version 3.116.1
Go Version go1.22.2
Go Compiler gc
Host
OS debian
Version 12.5
Arch x86_64
Additional context
No response
Contributing
Vote on this issue by adding a 👍 reaction.
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).
The text was updated successfully, but these errors were encountered: