Package
prometheus-fips-3.11
Component
github.com/prometheus/prometheus
Latest update
Fixed version
3.11.3-r3
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Fixed version
3.11.3-r3Impact
The package builds from upstream Prometheus v3.11.3, which is the release containing the fix (commit cc08568, remote/azuread: use Secret type for OAuth client_secret). The vulnerability is resolved in the binary; the scanner still reports it because the binary's embedded Go module pseudo-version (v0.x.y+dirty) is less than the firstPatchedVersion 0.311.3 the GHSA references — an artifact of prometheus's dual binary/module versioning scheme.
Status
Impact
This package is no longer supported upstream and has reached its end of life. A version upgrade is required to fix this vulnerability.
Status