Critical Vulnerability found in spilo-17:4.0-p3

[devadharpraveen29]

I could see a critical vulnerability reported for image version spilo-17:4.0-p3

ID : CVE-2024-45337
package : golang.org/x/crypto

Please let me know the mitigation or any planned updates to resolve this vulnerability

In addition there are 9 high vulnerabilities as well , below are the details

Package Vulnerability ID Severity
github.com/golang-jwt/jwt CVE-2025-30204 HIGH
github.com/golang-jwt/jwt/v4 CVE-2025-30204 HIGH
github.com/jackc/pgproto3/v2 GHSA-7jwh-3vrq-q3m8 HIGH
github.com/jackc/pgx CVE-2024-27289 HIGH
github.com/jackc/pgx CVE-2024-27304 HIGH
golang.org/x/crypto CVE-2025-22869 HIGH
golang.org/x/oauth2 CVE-2025-22868 HIGH
stdlib CVE-2025-47907 HIGH

[devadharpraveen29]

Follow-up : Please let me know if we have any update on this issue

[anuragkdi]

Hi Team - Could any of the maintainers take a look into the vulnerability. I see the fix is in the upgraded versions of the libraries. Any idea when the fix would be pushed?