Go Vulnerability present in the latest version of terraform-switcher
Hi Team,
We are using terraform-switcher for one of our application. We are adding the binary of the terraform-switcher to our application image.
When we ran trivy scan on the built image, we found below vulnerabilities. Suggestion is to upgrade the go version to 1.24.11 or 1.25.5. Is there any plan to upgrade the go module?
```
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)
For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/v0.61/docs/supply-chain/vex/repo#publishing-vex-documents
To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.
usr/local/bin/tfswitch (gobinary)
=================================
Total: 1 (HIGH: 1, CRITICAL: 0)
┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬───────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼───────────────────────────────────────────────────────────┤
│ stdlib │ CVE-2025-61729 │ HIGH │ fixed │ v1.25.3 │ 1.24.11, 1.25.5 │ crypto/x509: Excessive resource consumption when printing │
│ │ │ │ │ │ │ error string for host certificate validation... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-61729 │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴───────────────────────────────────────────────────────────┘
```
0 条评论