prometheus/client_golang

gopkg.in/yaml.v2:v2.4.0 is End Of Life support, Can we use v3?

ijajmulani opened this issue · 6 comments

ijajmulani commented

I can see gopkg.in/yaml.v2 is being used. Our BlackDuck scan shows gopkg.in/yaml.v2 version is EOLed. Hence can we update this component to latest v3 version.

bwplotka commented

Interesting. We don't use yaml. We will have to check in the transient dependency who uses it. At least Prometheus common has this. Can you add same issue on https://github.com/prometheus/common?

Thanks!

trend-shihyi-wu commented

Hello, due to the current inclusion of gopkg.in/yaml.v2@v2.4.0, a vulnerability CVE-2022-28948 has been detected. As per compliance requirements, it is necessary to address this issue within the given deadline. I would like to inquire if there are any plans to upgrade to gopkg.in/yaml.v3 v3.0.1 in order to resolve this matter. Thank you for your attention.

bwplotka commented

This project does not use anything related to YAML, it does not use this module, so it's not vulnerable.

Plus the vulnerability you mention is for v3 version only, not for v2 (see e.g. Teamwork/kommentaar#91 (comment))

ijajmulani commented

Hi @bwplotka
Looks as a sub dependency it yaml v2 is getting used. https://github.com/prometheus/client_golang/blob/main/go.mod#L29

vulnerability is for v2 version not for v3.

bwplotka commented

The fact it's in go.mod especially in indirect part, does not mean this code or the code we depend on actively use it. This likely comes from prometheus/common module and we don't use its types that additionally support some yaml encoding.

I still suspect the vuln is for v3 only. Can you show me the vuln part of v2 code?

Nevertheless we could check how to kill yaml indirect dep or move to v3, but it's not urgent IMO

bwplotka commented

Can you share any information about v2 EOL? Can't find any official statement.