spotahome / redis-operator

Redis Operator creates/configures/manages high availability redis with sentinel automatic failover atop Kubernetes.
Apache License 2.0
1.5k stars 356 forks source link

Update k8s dependencies and fix critica/high level vulnerabilities #540

Closed x-martinez closed 1 year ago

x-martinez commented 1 year ago
Library Vulnerability Severity Installed Version Fixed Version Title
github.com/emicklei/go-restful CVE-2022-1996 CRITICAL 2.9.5+incompatible 2.16.0 go-restful: Authorization Bypass Through User-Controlled Key https://avd.aquasec.com/nvd/cve-2022-1996
golang.org/x/net CVE-2022-27664 HIGH 0.0.0-20220225172249-27dd8689420f 0.0.0-20220906165146-f3363e06e74c golang: net/http: handle server errors after sending GOAWAY https://avd.aquasec.com/nvd/cve-2022-27664
golang.org/x/text CVE-2022-32149 HIGH 0.3.7 0.3.8 golang: golang.org/x/text/language: ParseAcceptLanguage takes a long time to parse complex tags https://avd.aquasec.com/nvd/cve-2022-32149

Good opportunity to update also the rest of k8s dependencies.

vseoane96 commented 1 year ago

@ese can you please review this?

ese commented 1 year ago

Thanks!

vseoane96 commented 1 year ago

Thanks!

Could you create a new tag for this version? @ese

ese commented 1 year ago

Thanks!

Could you create a new tag for this version? @ese

sure, let me do a little bit test and will release a new tag today