Fix CVE-2023-44487, CVE-2023-39325 and CVE-2023-3978

[wallrj]

• I ran trivy on the existing repo and observed the CVE vulnerability
• Ran go get golang.org/x/[email protected] && go mod tidy && go vet ./...

Before

$ trivy repository .
2023-10-24T09:46:09.142+0100    INFO    Vulnerability scanning is enabled
2023-10-24T09:46:09.142+0100    INFO    Secret scanning is enabled
2023-10-24T09:46:09.142+0100    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-10-24T09:46:09.142+0100    INFO    Please see also https://aquasecurity.github.io/trivy/v0.46/docs/scanner/secret/#recommendation for faster secret detection
2023-10-24T09:46:10.756+0100    INFO    Number of language-specific files: 1
2023-10-24T09:46:10.756+0100    INFO    Detecting gomod vulnerabilities...

go.mod (gomod)

Total: 3 (UNKNOWN: 0, LOW: 0, MEDIUM: 3, HIGH: 0, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Status │ Installed Version │ Fixed Version │                            Title                             │
├──────────────────┼────────────────┼──────────┼────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/net │ CVE-2023-39325 │ MEDIUM   │ fixed  │ 0.10.0            │ 0.17.0        │ rapid stream resets can cause excessive work                 │
│                  │                │          │        │                   │               │ (CVE-2023-44487)                                             │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
│                  ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2023-3978  │          │        │                   │ 0.13.0        │ Cross site scripting                                         │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-3978                    │
│                  ├────────────────┤          │        │                   ├───────────────┼──────────────────────────────────────────────────────────────┤
│                  │ CVE-2023-44487 │          │        │                   │ 0.17.0        │ Multiple HTTP/2 enabled web servers are vulnerable to a DDoS │
│                  │                │          │        │                   │               │ attack (Rapid...                                             │
│                  │                │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2023-44487                   │
└──────────────────┴────────────────┴──────────┴────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
...

After

$ trivy repository .
2023-10-24T09:47:03.422+0100    INFO    Vulnerability scanning is enabled
2023-10-24T09:47:03.422+0100    INFO    Secret scanning is enabled
2023-10-24T09:47:03.422+0100    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2023-10-24T09:47:03.422+0100    INFO    Please see also https://aquasecurity.github.io/trivy/v0.46/docs/scanner/secret/#recommendation for faster secret detection
2023-10-24T09:47:05.117+0100    INFO    Number of language-specific files: 1
2023-10-24T09:47:05.117+0100    INFO    Detecting gomod vulnerabilities...

[maelvls]

I can see that the images are built with the Go version 1.20, so that's good.

/lgtm
/approve

[jetstack-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: maelvls

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [maelvls]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[wallrj]

Verified that the image can be built and that cert-manager tests still pass:

• https://github.com/cert-manager/sample-external-issuer/releases/tag/v0.4.0-alpha.0
• Use sample-external-issuer v0.4.0 cert-manager#6439