how restful is used in harbor and what's impact of CVE-2022-1996 to harbor?

[danielzhanghl]

hi harbor team,
we are performing security scan to harbor src code, and found below restful version is in go.sum file, while there is critical CVE-2022-1996 on restful which fixed in V3 on Jun 2022:
https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1/

emicklei/go-restful#493

could you help to clarify what's this CVE impact to harbor? I did not see how that package is used in harbor.
thanks.

======
https://github.com/goharbor/harbor/blob/v2.6.4/src/go.sum:
github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
github.com/emicklei/go-restful/v3 v3.8.0 h1:eCZ8ulSerjdAiaNpF7GxXIE7ZCMo1moN1qX+S609eVw=
github.com/emicklei/go-restful/v3 v3.8.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=

[wy65701436]

did you try the latest version of v2.7 and if any security issue, please follow this process.