-
Bug
-
Resolution: Done
-
Normal
-
4.12
-
None
-
Low
-
None
-
CNF RAN Sprint 225
-
1
-
False
-
-
There are a couple of Dependabot alert in Github for hw-event-proxy regarding message-parser.
https://github.com/redhat-cne/hw-event-proxy/security/dependabot/4
https://github.com/redhat-cne/hw-event-proxy/security/dependabot/5
The python library protobuf needs to be upgrade to version 3.20.2 or later. For example:
protobuf>=3.20.2
Since the message-parser app is not exposed to outside of hw-event-proxy pod, it is not vulnerable to any direct DOS attacks. As such, there is no need to fix previous release. A fix in current release to remove the Github warnings should be sufficient.