Bug 2067870: Address CVE-2022-21698 #32
Conversation
See GHSA-cg3q-j54f-5p7p This patch upgrades `github.com/prometheus/client_golang` to v1.12, where the vulnerability has been fixed. This commit is the result of running: ``` go get github.com/prometheus/client_golang \ && go mod tidy && go mod vendor ``` **Notes for the reviewer**: One handy way to check that the version of `client_go` used for compiling contains the security patch, is to run `go mod vendor` and check that the `InstrumentRoundTripperCounter` method [contains a variadic `options` argument](prometheus/client_golang@v1.11.0...v1.11.1#diff-7871a83741d29b5f29e3c47d1c284f948c258a0c6fc18895f0c2d4204cc46054R63).
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: pierreprinetti The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
pierreprinetti
changed the title
openshift-ci
bot
added
bugzilla/severity-medium
|
@pierreprinetti: This pull request references Bugzilla bug 2067870, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker. 3 validation(s) were run on this bug
Requesting review from QA contact: DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
@pierreprinetti: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
@pierreprinetti: Some pull requests linked via external trackers have merged: The following pull requests linked via external trackers have not merged: These pull request must merge or be unlinked from the Bugzilla bug in order for it to move to the next state. Once unlinked, request a bug refresh with Bugzilla bug 2067870 has not been moved to the MODIFIED state. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
3 participants
See See the Prometheus advisory
What this PR does / why we need it:
This patch upgrades
github.com/prometheus/client_golangto v1.12,where the vulnerability has been fixed.
This commit is the result of running:
Notes for the reviewer:
One handy way to check that the version of
client_goused for compiling contains the security patch, is to rungo mod vendorand check that theInstrumentRoundTripperCountermethod contains a variadicoptionsargument.Release note: