[Bug] Critical and High vulnerability - CVE-2024-45337, CVE-2024-45338

[psmolkin]

The latest version 0.7.2 contains the following vulnerabilities:

CVE-2024-45337 (Critical)
CVE-2024-45338 (High)

Vulnerability details: https://nvd.nist.gov/vuln/detail/CVE-2024-45337
Vulnerability details: https://nvd.nist.gov/vuln/detail/CVE-2024-45338

Fix:
CVE-2024-45337 | golang.org/x/crypto | Critical | - | 0.31.0
CVE-2024-45338 | golang.org/x/net | High | - | 0.33.0

/kind support

[k8s-ci-robot]

This issue is currently awaiting triage.

If metrics-server contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[agomez-infoblox]

Any updates on these CVEs?

[alivalizadakaseya]

CVE-2019-1010022 & CVE-2005-2541 vulnerabilities also needs to be fixed which have CVSS score > 8.9 .

Could you please inform us whether any fix expected?

[girishr-github]

Any updates on these CVEs?

[nloke]

this is the latest CVES on v0.72 from a recent scan