Vulnerability - CVE-2023-44487

[ChristianZaccaria]

A new CVE has been found:

Introduced through: github.com/kubeflow/training-operator@0.0.0 › sigs.k8s.io/scheduler-plugins@v0.28.9 › k8s.io/kubernetes@v1.28.8

For some context:
https://www.cve.org/CVERecord?id=CVE-2023-44487
kubernetes/kubernetes#121197

Potential solution
Based on the Kubernetes issue mentioned above, several repositories have opted towards disabling HTTP2. Is this something we could/should do as well?

[tenzen-y]

@ChristianZaccaria Thank you for reporting this. Feel free to open PR.

[ChristianZaccaria]

@tenzen-y I am wondering if we are okay with disabling HTTP2 to resolve this? Thank you!

[tenzen-y]

@tenzen-y I am wondering if we are okay with disabling HTTP2 to resolve this? Thank you!

Oh, I assumed bumping kube libraries version is enough. But, we need to do something more.
So, could we decide on the approach after golang/go#63518 is concluded?