prometheus/common v0.67.5 CVE-2022-28948 CVE detected.

[yhzs8]

it uses go.yaml.in/yaml/v2 v2.4.3:

common/go.mod

Line 15 in 934ff37

go.yaml.in/yaml/v2 v2.4.3

According to GHSA-hp87-p4gw-j4gq the bug is fixed in >=3.0.1

[roidelapluie]

The bug affects gopkg.in/yaml.v3 , no go.yaml.in/yaml/v2