Latest azure-resource-manager image is vulnerable (TAG 24.3.0)- GHSA-8r3f-844c-mc37

[atiasadir]

Hey Everyone,

currently tag 24.3.0 is vulnerable
due to this package google.golang.org/protobuf v1.32.0

protobuf v1.32.0 :
This release contains commit protocolbuffers/protobuf-go@bfcd647, which fixes a denial of service vulnerability by preventing a stack overflow through a default maximum recursion limit. See golang/protobuf#1583 and golang/protobuf#1584 for details.

For more info, see here -

• x/vulndb: potential Go vuln in google.golang.org/protobuf/internal/encoding/json: GHSA-8r3f-844c-mc37 golang/vulndb#2639
• Full Changelog: protocolbuffers/protobuf-go@v1.31.0...v1.32.0

BR,
Adir Atias.

[atiasadir]

Hey @mblaschke

I added pull request to deal with this issue #110

LMK if I can help more