Skip to content

🔒 [IBM OSPO Security Notification] — IBM/cloud-operators #285

Open
Open
🔒 [IBM OSPO Security Notification] — IBM/cloud-operators#285
Labels
security

Description

@security-ops-bot
security-ops-bot
bot
opened on Sep 9, 2026

🔒 [IBM OSPO Security Notification] — IBM/cloud-operators

Action required: Remediate the alerts listed below before their SLA deadline.
This issue will be closed automatically once all alerts are resolved.

SLA policy: critical = 7 days, high = 30 days, medium = 90 days, low = no deadline.
Alerts at or above medium severity will trigger a warning comment before the deadline and
repo archiving if unresolved. Low-severity alerts are tracked here for visibility only —
they will never trigger warnings or archiving.

💡 Tip: To have Dependabot automatically open fix PRs for dependency alerts, enable
Dependabot security updates in your repo settings:
Settings → Advanced Security → Dependabot security updates → Enable.

Attention: @JohnStarich

Dependabot Alerts

Severity CVE/GHSA Package Affected Patched Deadline Fix PR
🔴 critical CVE-2023-49569 github.com/go-git/go-git/v5 >= 5.0.0, < 5.11.0 5.11.0 2026-10-23 —
🔴 critical CVE-2025-21613 github.com/go-git/go-git/v5 < 5.13.0 5.13.0 2026-10-20 —
🟠 high CVE-2022-41723 golang.org/x/net < 0.7.0 0.7.0 2026-11-15 PR
🟠 high CVE-2022-27664 golang.org/x/net < 0.0.0-20220906165146-f3363e06e74c 0.0.0-20220906165146-f3363e06e74c 2026-11-15 PR
🟠 high CVE-2022-41721 golang.org/x/net >= 0.0.0-20220524220425-1d687d428aca, < 0.1.1-0.20221104162952-702349b0e862 0.1.1-0.20221104162952-702349b0e862 2026-11-15 PR
🟠 high CVE-2023-39325 golang.org/x/net < 0.17.0 0.17.0 2026-11-15 —
🟠 high CVE-2023-49568 github.com/go-git/go-git/v5 < 5.11.0 5.11.0 2026-11-12 —
🟠 high CVE-2025-21614 github.com/go-git/go-git/v5 < 5.13.0 5.13.0 2026-11-12 —
🟠 high CVE-2026-45022 github.com/go-git/go-git/v5 < 5.19.0 5.19.0 2026-10-09 —
🟠 high CVE-2026-71556 github.com/go-git/go-git/v5 <= 5.19.1 5.19.2 2026-10-09 —
🟡 medium CVE-2023-3978 golang.org/x/net < 0.13.0 0.13.0 2027-01-14 —
🟡 medium CVE-2023-44487 golang.org/x/net < 0.17.0 0.17.0 2027-01-14 —
🟡 medium CVE-2023-45288 golang.org/x/net < 0.23.0 0.23.0 2027-01-14 —
🟡 medium CVE-2022-41717 golang.org/x/net < 0.4.0 0.4.0 2027-01-14 PR
🟡 medium CVE-2025-22870 golang.org/x/net < 0.36.0 0.36.0 2027-01-11 —
🟡 medium CVE-2025-22872 golang.org/x/net < 0.38.0 0.38.0 2027-01-11 —
🟡 medium CVE-2026-25934 github.com/go-git/go-git/v5 <= 5.16.4 5.16.5 2027-01-11 —
🟡 medium CVE-2026-34165 github.com/go-git/go-git/v5 >= 5.0.0, <= 5.17.0 5.17.1 2027-01-11 —
🟡 medium CVE-2026-41506 github.com/go-git/go-git/v5 <= 5.17.2 5.18.0 2026-12-15 —
🟡 medium CVE-2026-45571 github.com/go-git/go-git/v5 <= 5.19.0 5.19.1 2026-12-08 —
🟡 medium GHSA-w5pp-99ch-qj29 github.com/go-git/go-git/v5 <= 5.19.0 5.19.1 2026-12-08 —
🟡 medium CVE-2026-25680 golang.org/x/net < 0.55.0 0.55.0 2026-12-08 —
🟡 medium CVE-2026-71557 github.com/go-git/go-git/v5 <= 5.19.1 5.19.2 2026-12-08 —
🟡 medium GHSA-w67g-5rqw-f597 github.com/gorilla/websocket < 1.5.3 1.5.3 2026-12-08 —

Code Scanning Alerts

No open code scanning alerts.

Secret Scanning Alerts

No open secret scanning alerts.

Activity

  1. security-ops-bot
    added
    security
    on Sep 9, 2026

  2. security-ops-bot commented on Sep 10, 2026

    @security-ops-bot
    security-ops-botBot
    on Sep 10, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2022-41723, CVE-2022-27664, CVE-2022-41721, CVE-2023-3978, CVE-2023-39325, CVE-2023-44487, CVE-2023-49569, CVE-2023-45288, CVE-2022-41717, CVE-2023-49568, CVE-2025-21613, CVE-2025-21614, CVE-2025-22870, CVE-2025-22872, CVE-2026-25934, CVE-2026-33762, CVE-2026-34165

  3. security-ops-bot commented on Sep 12, 2026

    @security-ops-bot
    security-ops-botBot
    on Sep 12, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-41506

  4. security-ops-bot commented on Sep 16, 2026

    @security-ops-bot
    security-ops-botBot
    on Sep 16, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2022-41723 (high), CVE-2022-27664 (high), CVE-2022-41721 (high), CVE-2023-3978 (medium), CVE-2023-39325 (high), CVE-2023-44487 (medium), CVE-2023-49569 (critical), CVE-2023-45288 (medium), CVE-2022-41717 (medium), CVE-2023-49568 (high), CVE-2025-21613 (critical), CVE-2025-21614 (high), CVE-2025-22870 (medium), CVE-2025-22872 (medium), CVE-2026-25934 (medium), CVE-2026-33762 (low), CVE-2026-34165 (medium), CVE-2026-41506 (medium)

  5. security-ops-bot commented on Sep 17, 2026

    @security-ops-bot
    security-ops-botBot
    on Sep 17, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2022-41723, CVE-2022-27664, CVE-2022-41721, CVE-2023-3978, CVE-2023-39325, CVE-2023-44487

  6. security-ops-bot commented on Sep 18, 2026

    @security-ops-bot
    security-ops-botBot
    on Sep 18, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2022-41723 (high), CVE-2022-27664 (high), CVE-2022-41721 (high), CVE-2023-3978 (medium), CVE-2023-39325 (high), CVE-2023-44487 (medium)

  7. security-ops-bot
    changed the title [-]🔒 Security Alerts — IBM/cloud-operators[/-] [+]🔒 [IBM OSPO Security Notification] — IBM/cloud-operators[/+] on Sep 18, 2026

  8. security-ops-bot commented on Sep 20, 2026

    @security-ops-bot
    security-ops-botBot
    on Sep 20, 2026 – with security-ops-bot
    Author

    ⚠️ SLA Warning — IBM/cloud-operators

    The following 2 alerts are approaching their SLA deadline with 3 days remaining. Please remediate before the deadline to avoid automatic repository archiving.

    To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

    Alert Severity Deadline
    CVE-2023-49569 critical 2026-09-23
    CVE-2025-21613 critical 2026-09-23

    @JohnStarich

  9. security-ops-bot commented on Sep 22, 2026

    @security-ops-bot
    security-ops-botBot
    on Sep 22, 2026 – with security-ops-bot
    Author

    ⚠️ SLA Warning — IBM/cloud-operators

    The following 2 alerts are approaching their SLA deadline with 1 day remaining. Please remediate before the deadline to avoid automatic repository archiving.

    To prevent archiving, open a pull request that fixes each alert and include the alert ID (e.g. #CVE-XXXX-YYYY) in the PR title.

    Alert Severity Deadline
    CVE-2023-49569 critical 2026-09-23
    CVE-2025-21613 critical 2026-09-23

    @JohnStarich

  10. security-ops-bot commented on Sep 23, 2026

    @security-ops-bot
    security-ops-botBot
    on Sep 23, 2026 – with security-ops-bot
    Author

    🔒 Repository Archived — IBM/cloud-operators

    The following 2 alerts have exceeded their SLA deadline without being remediated. This repository has been archived.

    Alert Severity Deadline
    CVE-2023-49569 critical 2026-09-23
    CVE-2025-21613 critical 2026-09-23

    To request unarchiving, contact your security team and provide a remediation plan.

    @JohnStarich

  11. security-ops-bot commented on Oct 7, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 7, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2026-33762, CVE-2026-45570

  12. security-ops-bot commented on Oct 12, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 12, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Resolved: CVE-2022-41723, CVE-2022-27664, CVE-2022-41721, CVE-2023-3978, CVE-2023-39325, CVE-2023-44487, CVE-2023-49569, CVE-2023-45288, CVE-2022-41717, CVE-2023-49568, CVE-2025-21613, CVE-2025-21614, CVE-2025-22870, CVE-2025-22872, CVE-2026-25934, CVE-2026-34165

  13. security-ops-bot commented on Oct 13, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 13, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2023-49568 (high), CVE-2025-21613 (critical), CVE-2025-21614 (high), CVE-2025-22870 (medium), CVE-2025-22872 (medium), CVE-2026-25934 (medium), CVE-2026-34165 (medium)

  14. security-ops-bot commented on Oct 16, 2026

    @security-ops-bot
    security-ops-botBot
    on Oct 16, 2026 – with security-ops-bot
    Author

    🔄 Dependabot Alert Changes

    Added: CVE-2022-41723 (high), CVE-2022-27664 (high), CVE-2022-41721 (high), CVE-2023-3978 (medium), CVE-2023-39325 (high), CVE-2023-44487 (medium), CVE-2023-49569 (critical), CVE-2023-45288 (medium), CVE-2022-41717 (medium)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    security

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions