New release needed due to vulnerability in dependecy. about bellsoft-liberica

[dmikusa]

Totally agree on cutting a new release, we like to keep the images as clean as possible, but this CVE does not impact buildpacks. It's a server net/http issue and there is no usage of that code in buildpacks (client HTTP, yes, server no). So we'll catch up on this during the normal cycle of updates (weekly).

See from the release notes:

A closing HTTP/2 server connection could hang forever waiting for a clean shutdown that was preempted by a subsequent fatal error

[ASarco]

Thanks, I'm going to add the CVE to the .trivyignore file then.

[zargarf]

Hi - when is this fix likely to be released?

[dmikusa]

Probably this week. @pivotal-david-osullivan to confirm.

[pivotal-david-osullivan]

This should have been resolved in last week's release 9.7.0 - I released that version to address this CVE, as the indirect dependency of x/net was bumped to a patched release.

Running a Trivy scan locally confirms this, please let me know if you are seeing different results!

[pivotal-david-osullivan]

Closing this issue as it should be fixed with the above version and no further issues reported.