Update Go to 1.23.8 for CVE-2025-22871 #4133
Comments
KrzysztofKarol
added a commit
to KrzysztofKarol/esbuild
that referenced
this issue
Apr 9, 2025
dnegreira
added a commit
to dnegreira/advisories
that referenced
this issue
Apr 15, 2025
Currently the package is pulling esbuild from npm and building it locally. This also brings esbuild from upstream which is currently compiled using go1.23.7. esbuild already has an issue and PR open to have this fixed. More details here: evanw/esbuild#4133
dnegreira
added a commit
to dnegreira/advisories
that referenced
this issue
Apr 15, 2025
Currently the package is pulling esbuild from npm and building it locally. This also brings esbuild from upstream which is currently compiled using go1.23.7. esbuild already has an issue and PR open to have this fixed. More details here: evanw/esbuild#4133 Signed-off-by: David Negreira <[email protected]>
dnegreira
added a commit
to dnegreira/advisories
that referenced
this issue
Apr 15, 2025
Currently the package is pulling esbuild from npm and building it locally. This also brings esbuild from upstream which is currently compiled using go1.23.7. esbuild already has an issue and PR open to have this fixed. More details here: evanw/esbuild#4133 Signed-off-by: David Negreira <[email protected]>
github-merge-queue bot
pushed a commit
to wolfi-dev/advisories
that referenced
this issue
Apr 15, 2025
Currently the package is pulling esbuild from npm and building it locally. This also brings esbuild from upstream which is currently compiled using go1.23.7. esbuild already has an issue and PR open to have this fixed. More details here: evanw/esbuild#4133 Signed-off-by: David Negreira <[email protected]>
|
@evanw looking to see if this can be merged or comment a fix. Thanks. |
|
@evanw appreciate your time - this is being flagged by static code analysis tools and blocking CI/CD pipelines from proceeding |
|
Parroting that this also raised a flag on our vulnerability scanner and while not a blocker it is a point of pressure we're receiving from our security team. |
|
Great work! 🎉 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
There is another go vulnerability reported against the esbuild binary that is fixed in 1.23.8
Package: stdlib
Installed Version: v1.23.7
Vulnerability CVE-2025-22871
Severity: UNKNOWN
Fixed Version: 1.23.8, 1.24.2
Link: CVE-2025-22871
Usages
I create a PR based on #4076 and #4077.
The text was updated successfully, but these errors were encountered: