etcd-io / etcd UNCLAIMED

Distributed reliable key-value store for the most critical data of a distributed system

0 0 159 Go

Bump golang.org/x/image to v0.39.0 to resolve GO-2026-4962

Vulnerability #1: GO-2026-4962
    Excessive memory allocation when decoding malicious SFNT in
    golang.org/x/image
  More info: https://pkg.go.dev/vuln/GO-2026-4962
  Module: golang.org/x/image
    Found in: golang.org/x/image@v0.38.0
    Fixed in: golang.org/x/image@v0.39.0
    Example traces found:
      #1: pkg/chart/heatmaps.go:232:10: chart.plotComparisonHeatMapGrid calls plot.Legend.Draw, which eventually calls sfnt.Font.GlyphAdvance
      #2: pkg/chart/heatmaps.go:232:10: chart.plotComparisonHeatMapGrid calls plot.Legend.Draw, which eventually calls sfnt.Font.GlyphIndex
      #3: pkg/chart/heatmaps.go:232:10: chart.plotComparisonHeatMapGrid calls plot.Legend.Draw, which eventually calls sfnt.Font.Kern
      #4: pkg/chart/heatmaps.go:232:10: chart.plotComparisonHeatMapGrid calls plot.Legend.Draw, which eventually calls sfnt.Font.LoadGlyph
      #5: pkg/chart/heatmaps.go:31:2: chart.init calls draw.init, which eventually calls sfnt.Parse

Signed-off-by: Benjamin Wang <benjamin.ahrtr@gmail.com>

Benjamin Wang committed 4mo ago

2b63bad24d8993a2e033cec6e5b66c6a21b79ae7

Parent: f381593