New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Vulnerability with Go version with envsubst #49

Closed

ryanh-orca opened this issue Feb 13, 2023 · 1 comment · Fixed by #57

ryanh-orca commented Feb 13, 2023

With this CVE: https://nvd.nist.gov/vuln/detail/CVE-2022-27664, Go has vulnerability for any version before 1.18.6 or 1.19.1.

With latest release of envsubtr, it's using Go version 1.17: https://github.com/a8m/envsubst/blob/v1.4.2/go.mod#L3

Is there a plan to upgrade Go version to patch this CVE?

Owner

a8m commented Feb 13, 2023

Binaries are built with the latest Go version by default, but you can feel free to send a patch to fix the go.mod file. Thanks 🙏🏻

polarathene mentioned this issue

fix: Raise go.mod version above 1.19 #57

Merged

a8m closed this as completed in #57

This issue was closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment