Problems with GHSA-2v4p-qf9q-27wj

[easwars]

The grpc-go team recently published a security advisory: GHSA-2v4p-qf9q-27wj

The fix for the above vulnerability was made to our master branch after we cut the branch for release 1.84.0. The advisory initially mentioned that the vulnerability affected versions <=1.83.1, because at that point the most recent release was 1.83.1. As part of publishing the advisory we also pushed out a couple of patch releases, 1.82.2 and 1.83.2 and marked them as the patched versions in the advisory.

After publishing the advisory, we cherry-picked the change into the 1.84.x branch and pushed out 1.84.0 release that contained the fix.

But scanning tools are listing 1.84.0 to be affected by this vulnerability and downstream users of grpc-go using 1.84.0 are showing up as vulnerable.

How do we go about fixing this?

• I updated the patched versions in the advisory. I don't know if this is sufficient.
• I also approved Correct gRPC development ranges for GHSA-2v4p-qf9q-27wj #9608 that directly fixes the database. When and by whom would this PR be merged? Is this sufficient?

Please let us know if there is something more needs to be done from our side.

Thanks

[easwars]

@raphael @justinsb @vancluever @Pranjali-2501