grafana-7
Chainguard
6.1
CVSS CVSS_V3
Status
Justification
Impact
Prometheus ships a Go (Golang) library with a versioning scheme that follows the 0.x format. However, the Prometheus application itself uses a versioning scheme based on 1.x, 2.x, etc. The vulnerability identified in CVE-2019-3826 is specifically associated with the Prometheus application, not the Golang library.
Status
Justification
Impact
This impacts the Prometheus UI, and according to https://github.com/grafana/grafana/issues/34633#issuecomment-848552586 Grafana does not include that