Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[release-3.5] go.mod: Upgrade to prometheus/client_golang v1.11.1 #13895

Merged
merged 1 commit into from
Apr 7, 2022

Conversation

mrueg
Copy link
Contributor

@mrueg mrueg commented Apr 6, 2022

I believe this is not exploitable in etcd, this change will calm down vulnerability scanners though. See also: GHSA-cg3q-j54f-5p7p

via grype:

NAME                                 INSTALLED  FIXED-IN  VULNERABILITY   SEVERITY 
github.com/prometheus/client_golang  v1.11.0              CVE-2022-21698  High      

@mrueg mrueg mentioned this pull request Apr 6, 2022
28 tasks
@serathius
Copy link
Member

serathius commented Apr 6, 2022

Can you first create a PR for main branch? PRs for release-3.5 should be backports from main.

@serathius serathius merged commit 238b18c into etcd-io:release-3.5 Apr 7, 2022
ahrtr added a commit to ahrtr/etcd that referenced this pull request Jul 4, 2022
Cherry pick etcd-io#13895 to 3.4.

Signed-off-by: Benjamin Wang <wachao@vmware.com>
ahrtr added a commit to ahrtr/etcd that referenced this pull request Jul 8, 2022
Cherry pick etcd-io#13895 to 3.4.

Signed-off-by: Benjamin Wang <wachao@vmware.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

3 participants