Security Vulnerability CVE-2022-28948 (Medium) detected

[Sher-Chowdhury]

This relates to:

controller-runtime/go.mod

Line 26 in 196828e

sigs.k8s.io/yaml v1.3.0

As per https://www.mend.io/vulnerability-database/CVE-2022-28948, would it be possible to upgrade this yaml package to v3.0.0?

Note that this CVE incorrectly relates to v3 when it should be about v2. See here: go-yaml/yaml#666 (comment)

[dylan-tock]

@Sher-Chowdhury To make sure this is explicitly clear, the v2 version of go-yaml is NOT affected, only the v3 version (and there is a patch to fix that vulnerability). The way I read your last sentence, it appears to me you're saying the opposite and I wanted to insure nobody else read it that way.

[Sher-Chowdhury]

Related dependency issue raised here - kubernetes-sigs/yaml#78

Once A new version of sigs.k8s.io/yaml is released that includes this CVE fix, this version needs to then be consumed by this repo.

[alvaroaleman]

Thanks for reporting, but according to kubernetes-sigs/yaml#78 this doesn't actually affect sigs.k8s.io/yaml.