Security vulnerability in golang.org/x/net package about memcached_exporter HOT 3 CLOSED

Please do not report raw vulnerability scanner results. They are prone to false positives and cause the Prometheus team toil in verifying. Please verify vulnerability reports and include specific details as to which components are directly exploitable. Please also include a reproduction case.

from memcached_exporter.

Dear @SuperQ,
In case of an explicit package version declaration the fix would be changing a single digit.
Otherwise it's just rebuilding, committing, pushing and merging.

Does your reply mean that this fix would be done if and only if:

1. The security breach found in code and exploit is implemented
2. Reproduction documentation is present

?

The time taken for making such a research (by non security expert) is significantly more than waiting for the next project rebuild (on average).

Thank you.

from memcached_exporter.

To add, we have dependabot to automatically update our repos. So filing individual requests to every Prometheus repo wastes both your time and ours.

from memcached_exporter.