gorilla/websocket

Address CVE-2023-45288

ojcm opened this issue · 1 comments

ojcm commented

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

CVE-2023-45288 / GO-2024-2687 was recently published and govuln flags this repository as vulnerable. I believe the changes required to resolve this are:

  • Upgrade Go version to 1.21.9 or 1.22.2
  • Upgrade golang.org/x/net to v0.23.0

Expected Behavior

govuln does not detect any vulnerabilities

Steps To Reproduce

govulncheck ./...

Anything else?

https://pkg.go.dev/vuln/GO-2024-2687

ojcm commented

govulncheck is no longer flagging this repo as vulnerable.