publicly reported security vulnerabilities

[dppatel99]

Hi team,

In our vulnerability scan report there are 3 HIGH and 2 CRITICAL vulnerabilities in kube-state-metrics/kube-state-metrics:2.7.0

Component	Vulnerability	Severity	Installed Version	Latest Version	Description
golang-runtime	CVE-2023-24538	CRITICAL	1.19.4	1.20.3	GHSA-v4m2-x4rp-hv22
golang-runtime	CVE-2023-24536	HIGH	1.19.4	1.20.3	GHSA-9f7g-gqwh-jpf5
golang-runtime	CVE-2023-24534	HIGH	1.19.4	1.20.3	GHSA-8v5j-pwr7-w5f8
golang-runtime	CVE-2023-24537	HIGH	1.19.4	1.20.3	GHSA-fp86-2355-v99r
etcd	CVE-2021-28235	CRITICAL	MISSING	v3.6.0-alpha.0	GHSA-gmph-wf7j-9gcm

My suggestion: Golang version update to 1.20.3 should solve the problem.

[k8s-ci-robot]

This issue is currently awaiting triage.

If kube-state-metrics contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[RamakrishnanArun]

I did not create a Pull Request as yet but this comparison from my fork to the main branch upstream should resolve the issues. I ran a scan after building an image locally with 1.20.3 and see no issues reported.

main...RamakrishnanArun:kube-state-metrics:security/1.20.3

[RamakrishnanArun]

Submitted a PR #2056 for this.
Note: this address the "golang-runtime" related issues.

[dppatel99]

Thanks !! I will be waiting for it to get merged and released