CVE-2023-45286: HTTP request body disclosure

Question

CVE-2023-45286: HTTP request body disclosure

tommed opened this issue 7 months ago · comments

You have an open security issue: GO-2023-2328.
It also has an assigned CVE: https://www.cve.org/CVERecord?id=CVE-2023-45286

Are you able to provide a fix please? Is there a known workaround which isn't known by the CVE.

Christian Fiderer · Answer 1 · Thu Dec 21 2023 15:56:47 GMT+0800 (China Standard Time)

This issue is known since November 2, and PR #745 waits for approval since three weeks.

Tom · Answer 2 · Thu Dec 21 2023 16:31:53 GMT+0800 (China Standard Time)

Ok understood thanks.

3 weeks for a CVE fix to be approved seems a little unresponsive? We'll need to mark this in our Technical Compliance Report and determine whether the risk is worth it. Good luck with the PR!

Jeevanandam M. · Answer 3 · Wed Dec 27 2023 13:44:21 GMT+0800 (China Standard Time)

@tommed Thanks for reaching out. I have been traveling on vacation days and will return from vacation in the first week of January.
I'm sorry for not checking my emails and notifications properly these days.

PR #745 is merged; I'm making a release.