Closed jmaitrehenry closed 3 months ago
jmaitrehenry
commented
7 months ago Will not completely fix the project CVE as this PR will add a new vuln, but with a lower score. I created this issue to discuss about the new CVE added by this PR: https://github.com/opensearch-project/terraform-provider-opensearch/issues/151
prudhvigodithi
commented
6 months ago Thanks for the contribution @jmaitrehenry, following are security checks failing can you please check?
jmaitrehenry
commented
6 months ago @prudhvigodithi Actually, the upstream project doesn't have a fix for the CVE. I created an issue where I purpose to migrate to aws-sdk-go-v2: #151
prudhvigodithi
commented
6 months ago Thanks @jmaitrehenry, LGTM. Since you are aware of this can you please give a stab to change the code to aws-sdk-go-v2 ?
Thanks
Adding @bbarani @peterzhuamazon @rblcoder
jmaitrehenry
commented
6 months ago @prudhvigodithi I will check when I will have some time available to do it!
prudhvigodithi
commented
3 months ago Thanks @jmaitrehenry closing this PR as this is taken care as part of the repo go upgrade to 1.22 https://github.com/opensearch-project/terraform-provider-opensearch/pull/187. @rblcoder @bbarani
Description
Update AWS SDK to latest version for updating the transient golang.org/x/net-v0.1.0 package.
Issues Resolved
Close https://github.com/opensearch-project/terraform-provider-opensearch/issues/119
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. For more information on following Developer Certificate of Origin and signing off your commits, please check here.