Vulnerability with postgresql driver about hakai-datasets

[steviewanders]

Can you post the original text/document. Missing details and context.

[JessyBarrette]

This is coming from the ERDDAP google chat. Here's the thread
https://groups.google.com/g/erddap/c/HrqztnJEBBc/m/P_3vdxkyAwAJ?utm_medium=email&utm_source=footer

[JessyBarrette]

FIY this is also where all the historical discussions regarding ERDDAP lives. Some of it is now living within the ERDDAP GitHub Repository.

[JessyBarrette]

Seems straightforward to manage our side by mounting the driver within the containers either via docker-compose for the present main/dev branch or Dockerfile for caprover-deploy

This is only affecting the Hakai ERDDAP which pointing to the Hakai PostgreSQL database.

[steviewanders]

This is coming from the ERDDAP google chat. Here's the thread https://groups.google.com/g/erddap/c/HrqztnJEBBc/m/P_3vdxkyAwAJ?utm_medium=email&utm_source=footer

This also does not link to or mention what the actual vulnerability is or a CVE?

[steviewanders]

GHSA-v7wg-cpwc-24m4

[steviewanders]

Basically only an issue if you expose the Postgresql connection string, which we do not.

So can be fixed as part of a normal upgrade process, whatever we decide that is.

@JessyBarrette Can you link to the commit to the Dockerfile that is being deployed here when you upgrade it please.