Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-42814Denial of service from malicious image manifest in kyvernoGo · github.com/kyverno/kyverno · fixed in 1.5.0-rc1.0.20230918070231-fec2992e3f9f
- CVE-2023-42815Denial of service from malicious image manifest in kyvernoGo · github.com/kyverno/kyverno · fixed in 1.5.0-rc1.0.20230918070231-fec2992e3f9f
- CVE-2023-42816Denial of service from malicious signature in kyvernoGo · github.com/kyverno/kyverno · fixed in 1.5.0-rc1.0.20230918070231-fec2992e3f9f
- CVE-2023-47390Headscale through 0.22.3 writes bearer tokens to info-level logs.Go · github.com/juanfont/headscale
- CVE-2023-47122Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.Go · github.com/sigstore/gitsign · fixed in 0.8.0
- CVE-2023-47108DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metricsGo · go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc · fixed in 0.46.0
- CVE-2023-5954Vault Requests Triggering Policy Checks May Lead To Unbounded Memory ConsumptionGo · github.com/hashicorp/vault · fixed in 1.13.10, 1.14.6, 1.15.2
- CVE-2023-45284Incorrect detection of reserved device names on Windows in path/filepathGo · stdlib · fixed in 1.20.11, 1.21.4
- CVE-2023-45283Insecure parsing of Windows paths with a \??\ prefix in path/filepathGo · stdlib · fixed in 1.20.11, 1.21.4, 1.20.12 and more
- CVE-2023-20902Timing attack risk in HarborGo · github.com/goharbor/harbor · fixed in 1.10.18, 2.7.3+incompatible, 2.8.3+incompatible and more
- CVE-2023-47111ZITADEL race condition in lockout policy executionGo · github.com/zitadel/zitadel · fixed in 2.40.5, 2.38.3
- CVE-2023-46737Possible endless data attack from attacker-controlled registry in cosignGo · github.com/sigstore/cosign, github.com/sigstore/cosign/v2 · fixed in 1.13.2, 2.2.1
- CVE-2023-46254Service accounts can see namespaces of other tenants in capsule-proxyGo · github.com/projectcapsule/capsule, github.com/projectcapsule/capsule-proxy · fixed in 0.4.5
- CVE-2023-5969 Denial of Service via Link Preview in /api/v4/redirect_locationGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.12, 8.0.4, 8.1.3 and more
- CVE-2023-5968Password hash in response body after username updateGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 5.3.2-0.20230825233148-f787fd63368a, 7.8.12, 8.0.4 and more
- CVE-2023-5967Denial of Service via crashing the Calls PluginGo · github.com/mattermost/mattermost-server/v6, github.com/mattermost/mattermost/server/v8 · fixed in 7.8.12, 8.0.4, 8.1.3 and more
- CVE-2023-41378Calico Typha hangs during unclean TLS handshakeGo · github.com/projectcalico/calico · fixed in 3.26.3
- CVE-2023-3893Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalationGo · github.com/kubernetes-csi/csi-proxy, github.com/kubernetes-csi/csi-proxy/v2 · fixed in 1.1.3, 0.0.0-20230821192013-2523e6674ded, 1.1.3-0.20230821192013-2523e6674ded and more
- CVE-2023-3955Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationGo · k8s.io/kubernetes, k8s.io/mount-utils · fixed in 1.28.1, 1.27.5, 1.26.8 and more
- CVE-2023-3676Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalationGo · k8s.io/kubernetes · fixed in 1.28.1, 1.27.5, 1.26.8 and more
- CVE-2023-46255`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsedGo · github.com/authzed/spicedb · fixed in 1.27.0-rc1
- CVE-2023-46239quic-go vulnerable to pointer dereference that can lead to panicGo · github.com/quic-go/quic-go · fixed in 0.37.3
- CVE-2023-46129xkeys Seal encryption used fixed key for all encryptionGo · github.com/nats-io/nats-server/v2, github.com/nats-io/nkeys · fixed in 2.10.4, 0.4.6
- CVE-2023-41891FlyteAdmin SQL Injection in List FiltersGo · github.com/flyteorg/flyteadmin · fixed in 1.1.124
- CVE-2021-25736Windows kube-proxy LoadBalancer contentionGo · k8s.io/kubernetes · fixed in 1.21.0
- CVE-2023-47090NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass.Go · github.com/nats-io/nats-server/v2 · fixed in 2.9.23, 2.10.2
- CVE-2023-5834Vagrant’s Windows Installer Allowed Directory Junction WriteGo · github.com/hashicorp/vagrant · fixed in 2.4.0
- CVE-2023-5044Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotationGo · k8s.io/ingress-nginx · fixed in 1.9.0
- CVE-2023-5043Ingress nginx annotation injection causes arbitrary command executionGo · k8s.io/ingress-nginx · fixed in 1.9.0
- CVE-2022-4886Ingress-nginx `path` sanitization can be bypassed with `log_format` directiveGo · k8s.io/ingress-nginx · fixed in 1.8.0