Integer Overflow or Wraparound in go-kit dependency

[kari-awake]

Nancy tool reports CWE-190: Integer Overflow or Wraparound in:

go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738

etcd-io/etcd#12605
fixed in etcd-io/etcd#12645

It's fixed in release-3.4 branch but it seems that there is no tag yet that has this fix..

[peterbourgon]

We're waiting for a new etcd release for some other reasons, too...

[kari-awake]

Any updates on this? Latest etcd 3.4.15...

[peterbourgon]

I spent 10 minutes trying to update Go kit's etcd version, and couldn't figure it out. The etcd repo doesn't appear to follow Go modules' conventions. Can someone give me a tip?

[peterbourgon]

Oops.

[kari-awake]

related? #1067

[sagikazarmark]

This is fixed on master, will be released soon.