CVE-2023-48795: metrics-server...temporal

Signed-off-by: Philippe Deslauriers <[email protected]>

metrics-server.advisories.yaml

@@ -166,3 +166,12 @@ advisories:
         type: pending-upstream-fix
         data:
           note: Pending upstream fix, this fix will require some code changes due to the usage of one year old Kubernetes dependencies (e.g. k8s.io/[email protected]). These dependencies need to be updated to upgrade the vulnerable otel dependencies. In addition, the latest stable release of the metrics-server project was triggered on June.
+
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-22T15:01:54Z
+        type: fixed
+        data:
+          fixed-version: 0.6.4-r9

prometheus-mongodb-exporter.advisories.yaml

@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: prometheus-mongodb-exporter
@@ -41,3 +41,12 @@ advisories:
         data:
           type: vulnerable-code-not-included-in-package
           note: Only affects Windows
+
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-22T15:02:11Z
+        type: fixed
+        data:
+          fixed-version: 0.40.0-r2

temporal-server.advisories.yaml

@@ -37,3 +37,12 @@ advisories:
         data:
           note: |
             We faced issues with "[email protected]/internal/transform/metricdata.go:108:18:undefined: metricdata.ExponentialHistogram" when upgrading otlpmetricgrpc to v0.46.0. It has some strict dependencies in the source code common/telemetry using an old version and thus this fix will require some code changes in upstream.
+
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-22T15:02:24Z
+        type: fixed
+        data:
+          fixed-version: 1.22.3-r3

temporal.advisories.yaml

@@ -1,4 +1,4 @@
-schema-version: 2.0.1
+schema-version: 2.0.2
 
 package:
   name: temporal
@@ -50,3 +50,12 @@ advisories:
         data:
           note: |
             We faced issues with "[email protected]/internal/transform/metricdata.go:108:18:undefined: metricdata.ExponentialHistogram" when upgrading otlpmetricgrpc to v0.46.0. It has some strict dependencies in the source code common/telemetry using an old version and thus this fix will require some code changes in upstream.
+
+  - id: CVE-2023-48795
+    aliases:
+      - GHSA-45x7-px36-x8w8
+    events:
+      - timestamp: 2023-12-22T15:02:35Z
+        type: fixed
+        data:
+          fixed-version: 0.10.7-r3