Go Binaries shipped with critical CVE-2023-39323
Closed this issue · 3 comments
kennethye1 commented
Summary
Go binaries are shipped with critical CVE-2023-39323.
Can we upgrade the Go versions to go 1.21.3 or 1.20.10?
natalieparellano commented
@kennethye1 thanks for opening this issue. This will be fixed in 0.18.0 - we are readying the release candidate 0.18.0-rc.1 as we speak. We usually let the release candidate bake for a day or two before we cut the "real" one. It's worth noting that CVE-2023-39323 is non-exploitable as we don't use cgo.
natalieparellano commented
Actually, I think we could patch this in a 0.17.2 - as 0.18.0 will remove support for deprecated buildpack and platform APIs, there may be some users who need extra time to upgrade, so another 0.17.x would help in the meantime. This could probably go out today...
natalieparellano commented