package golang.org/x/net is vulnerable

[sm171190]

Latest release of kubectl uses a vulnerable version of golang.org/c/net (v0.30.0).
(We should be using something higher than v0.33.0.
I see that master is using v0.33.0. Maybe we can make a release off of it ?

https://access.redhat.com/security/cve/cve-2024-45338

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG CLI takes a lead on issue triage for this repo, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ardaguclu]

kubectl uses x/net 1.33 version

kubectl/go.mod

Line 85 in 2fd8e36

golang.org/x/net v0.33.0 // indirect

/close

[k8s-ci-robot]

@ardaguclu: Closing this issue.

In response to this:

kubectl uses x/net 1.33 version

kubectl/go.mod

Line 85 in 2fd8e36

golang.org/x/net v0.33.0 // indirect

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[sm171190]

kubectl uses x/net 1.33 version

kubectl/go.mod

Line 85 in 2fd8e36

golang.org/x/net v0.33.0 // indirect
/close

That is the master branch, not the release tag

[ardaguclu]

You can get more information from kubernetes/kubernetes#129349