go package Vulnerability observed in promethus/grafana for alertmanager

[golakotigopala]

While scanning by using twist locks , we have observed few go package vulnerabilities for the alert manger

prometheus/alertmanager version : v0.24.0

Description: In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

Alert manger is using 1.17 version to compile the binary and this have the following CVE
CVE-2022-27664

Do you have any plan to release alertmanager version with the latest go package version of 1.19.1?

[hpvd]

also documented in latest summary of vulnerabilities: #3117

[golakotigopala]

when will be get the latest alertmanager version with the latest go package version of 1.19.1 or 1.19.2 ? Could you suggest the ETA for the same?

[simonpasquier]

closed by #3187