Package
grafana-tempo-datasource-fips
Component
github.com/grafana/tempo
Latest update
7.5
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
The detected component (github.com/grafana/tempo) is built from an upstream revision that contains the fix for this issue: since 13.1.5-r2 (grafana-tempo-datasource) / 13.1.5-r1 (grafana-tempo-datasource-fips) the module is pinned to the v3.0.3 tag commit 1900ed7bb5ca, of which the upstream fix commit bb8ca663db34 (tempo PR #6711) is an ancestor. tempo keeps the v1 module path (no /v2 or /v3 suffix), so the built revision carries a v1.x pseudo-version that sorts below the v2.x release tags listed as fixed; version-range scanners therefore flag it even though the patched code is present in the shipped binary. The plugin binary also only imports github.com/grafana/tempo/pkg/tempopb; the fix lives in tempodb/backend/s3, which is not linked into the plugin.
Status