Security Vulnerabilities

[kothabindu]

No description provided.

[amccague]

Can I second this. v0.23.0 has the following active critical severity vulnerability:

CVE-2021-38297
Go
1.16.7
fixed in 1.17.2, 1.16.9

[amccague]

@roidelapluie could I encourage a release, there hasn't been one in a while. (I'm not sure if you're the right person to ask mind so I apologise for the direct tag if not)
This critical CVE should have been resolved through #2792

[amccague]

Or @SuperQ

[hoffie]

Can I second this. v0.23.0 has the following active critical severity vulnerability:

CVE-2021-38297 Go 1.16.7 fixed in 1.17.2, 1.16.9

According to NVD, this vulnerability only affects code which is being compiled for WASM/JS. Are you compiling and using Alertmanager (i.e. the Go code, not the web UI) in such a way? I think this would be a very niche use case for alertmanager.

Not saying that I'd vote against a fresh release with updated components, just wanted to chime in to clarify that the referenced CVE does not sound critical (or even relevant) to standard Alertmanager use cases.

[amccague]

Can I second this. v0.23.0 has the following active critical severity vulnerability:
CVE-2021-38297 Go 1.16.7 fixed in 1.17.2, 1.16.9

According to NVD, this vulnerability only affects code which is being compiled for WASM/JS. Are you compiling and using Alertmanager (i.e. the Go code, not the web UI) in such a way? I think this would be a very niche use case for alertmanager.

Not saying that I'd vote against a fresh release with updated components, just wanted to chime in to clarify that the referenced CVE does not sound critical (or even relevant) to standard Alertmanager use cases.

Whilst I absolutely agree this is the case and unlikely exploitable in this case - it does not scale well for organisations to inspect every vulnerability that arises if they can be exploited in their particular settings. Normally when there is a fix published many, in particular regulated industries, will expect it to be resolved to reduce noise and overheads.

[simonpasquier]

closed by #3187