CVE-2021-3538

[martinhrvn]

Hi, any chance of releasing new patch version that includes this PR: #690

There is CVE-2021-3538 that was fixed in that PR.

Thanks :)

[lance6716]

@atercattus do you have time to release a new version 😄

[atercattus]

OK, I'll do it today 👍

[atercattus]

https://github.com/go-mysql-org/go-mysql/blob/master/CHANGELOG.md#tag-v150-2022-04-30

[dveeden]

Maybe this should be listed on https://github.com/go-mysql-org/go-mysql/security/advisories ?
I also assume this issue should be closed?

[dveeden]

@atercattus @lance6716 ?

[lance6716]

I have published https://github.com/go-mysql-org/go-mysql/security/advisories/GHSA-rc7v-65v6-m2v3 for this package, closing now.

[dveeden]

@lance6716

On the right it says "No known CVE", shouldn't it say "CVE-2021-3538"?

[lance6716]

I'm not sure if that CVE identifier should be only used by github.com/satori/go.uuid . I'll check other repo's security advisories later 😂

[lance6716]

It's hard to find a reference that I can follow their action. Most repo does not publish security advisories 😂

[dveeden]

Let's leave it as is for now