Upgrade to go 1.21.2+

[vinsonxing]

Hi,

Do you have plan to upgrade the golang version to 1.21.2+ (currently the grpcurl 1.8.9 is built on top of golang 1.21.1)? In our security scanning, we get a Critical issue in 1.21.1 (CVE-2023-39323)

Thanks

[gfrankliu]

Our scanner also complained https://nvd.nist.gov/vuln/detail/CVE-2023-44487 due to go 1.21.1

Apart from go, there is also grpc version that needs to be upgraded: GHSA-m425-mq94-257g

[lokeshmavale]

Same, Critical issue with: GHSA-m425-mq94-257g

[vinsonxing]

will this be fixed in a new version? what's the timeline?

[dragonsinth]

There's no threat model for either of these vulns for gRPCurl. So we have no urgency to address them.

[enakshipriya]

I am not raising another issue because I found this open one. Even in our case we are getting security vuln due the below CVE-ids which require upgrade to golang version 1.21.2+

CVE-2023-39323
CVE-2023-45285
CVE-2023-45283
CVE-2023-39325
CVE-2023-45284
CVE-2023-39326