Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade to newer alertmanager dependency to remediate GHSA-v86x-5fm3-5p7j #697

Open
mamccorm opened this issue Nov 20, 2024 · 0 comments
Open

Comments

@mamccorm
Copy link

The latest release of promxy is vulnerable to GHSA-v86x-5fm3-5p7j, due to a dependency on an old version of alertmanager:

promxy/go.mod

Line 129 in c6ce66d

github.com/prometheus/alertmanager v0.24.0 // indirect

Attempted bumping this to the minimum version required to address this CVE (v0.25.1), but results in the following build errors:

vendor/github.com/prometheus/prometheus/web/web.go:617:49: cannot use webConfig (variable of type string) as *"github.com/prometheus/exporter-toolkit/web".FlagConfig value in argument to toolkit_web.Serve

Not quite sure how to remediate this one - may require code changes or bumping other dependencies?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant