[Security] Workflow stale.yml is using vulnerable action actions/stale #3492
Assignees
Labels
Comments
|
Hi @akulpillai -- would you like to go ahead and contribute the fix? |
|
@akulpillai Thanks for creating an issue regarding the same, the OpenEBS community takes security very seriously, do let us know how you keep yourself abreast with all things security(viz some scanners, or just a loose set of channels like mailing-lists, Reddit, HackerNews, etc) 👋🏼 Aside, we hang out in #openebs-dev in the K8s Slack, where we get deep and discuss, do drop in to say hi. |
vharsh
pushed a commit
to vharsh/openebs
that referenced
this issue
Jan 7, 2022
fixes: openebs#3492 Signed-off-by: Harsh Vardhan <harsh.vardhan@mayadata.io>
Merged
shubham14bajpai
pushed a commit
that referenced
this issue
Jan 13, 2022
fixes: #3492 Signed-off-by: Harsh Vardhan <harsh.vardhan@mayadata.io>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The workflow stale.yml is referencing action actions/stale using references v1. However this reference is missing the commit af4072615903a8b031f986d25b1ae3bf45ec44d4 which may contain fix to the some vulnerability.
The vulnerability fix that is missing by actions version could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider to update the reference to the action.
The text was updated successfully, but these errors were encountered: