Package
grafana-tempo-datasource-fips
Component
github.com/grafana/tempo
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
The detected component (github.com/grafana/tempo) is built from an upstream revision that already contains the fix for this issue: the upstream fix commit 650eb1985a07 (tempo PR #6525) is an ancestor of the pinned revision (b13f74291d48; from 13.1.5-r2 / fips 13.1.5-r1 the pin is the v3.0.3 tag commit 1900ed7bb5ca). tempo keeps the v1 module path (no /v2 or /v3 suffix), so the built revision carries a v1.x pseudo-version that sorts below the v2.x release tags listed as fixed; version-range scanners therefore flag it even though the patched code is present in the shipped binary. The plugin binary also only imports github.com/grafana/tempo/pkg/tempopb; the fix lives in modules/frontend/config.go, which is not linked into the plugin.
Status