Security Issue with gogo/protobuf while importing go.etcd.io/etcd

[dochri]

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue. go-kit/kit is using go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738 which import gogo/protobuf v.1.1.1. The go.etcd.io/etcd package is now in version v3.4.16 which now uses version 1.3.2 of gogo/protobuf. Is it possible to update the version to eliminate the security issue.

[peterbourgon]

#1067