CVE-2024-24791 in sops binary v3.9.0

[oschni]

Our scanning jobs have identified a new CVE "CVE-2024-24791" in the sops binary v3.9.0. This is an issue with the Go standard library net/http.

Is it possible to rebuilt sops binaries once the vulnerability has been fixed?

[duthils]

This CVE is fixed in go 1.22.5, see the release announcement.

The go toolchain was updated to 1.22.5 in #1589

[felixfontein]

I know almost nothing about how goreleaser works, but the release workflow still runs with Go 1.21.x. I created #1615 to change that. (PR to update Go version in CI: #1531.)

[duthils]

Oh, right... For the record, the CVE issue is also fixed in 1.21.12, see the release announcement.

[reneleonhardt]

FYI the latest security fixes have not been backported anymore, so 1.21.13 shoudn't be used anymore:
https://go.dev/doc/devel/release#go1.22.7