kubernetes-csi/node-driver-registrar

High risk vulnerability with v2.7.0

bbindela opened this issue · 4 comments

bbindela commented

Hi Team,

We have one High risk vunerability with v2.7.0

golang.org/x/net version v0.4.0 has 1 vulnerability

image

Can you please help us by fixing this.
With this, node-driver-registrar will be vulnerability free.

Thank you.

liangyuanpeng commented

It's possible update the node-driver-registrar version?

k8s-triage-robot commented

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue as fresh with /remove-lifecycle stale
  • Close this issue with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

jsafrane commented

/close
This has been fixed since v2.8.0 that has golang.org/x/net v0.8.0

Since CVE patching is done manually by volunteers, we strongly prefer PRs instead of issues.

k8s-ci-robot commented

@jsafrane: Closing this issue.

In response to this:

/close
This has been fixed since v2.8.0 that has golang.org/x/net v0.8.0

Since CVE patching is done manually by volunteers, we strongly prefer PRs instead of issues.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.