-
Notifications
You must be signed in to change notification settings - Fork 676
Description
The node-problem-detector is currently utilizing a version of the github.com/aws/aws-sdk-go that is approaching its end-of-life. According to the official AWS announcement, AWS SDK for Go v1 will reach its end-of-support on July 31, 2025.[1][2][3] After this date, it will no longer receive updates, including critical bug fixes and security patches.[1][2][4]
A customer's vulnerability scanner has flagged the following dependency in /home/kubernetes/bin/node-problem-detector as an EOL version:
pkg:go/github.com/aws/aws-sdk-go(1.44.72)
This is also reflected in the go.sum file on line 114:
github.com/aws/aws-sdk-go v1.44.72 h1:i7J5XT7pjBjtl1OrdIhiQHzsG89wkZCcM1HhyK++3DI=
github.com/aws/aws-sdk-go v1.44.72/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
To ensure the security and stability of the node-problem-detector, it is crucial to migrate from the EOL AWS SDK for Go v1 to v2. AWS has provided a migration guide to facilitate this transition.
Please prioritize this upgrade to mitigate any potential risks associated with using an unsupported SDK.