Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-44273Consensys gnark-crypto through 0.11.2 allows Signature Malleability.Go · github.com/consensys/gnark-crypto · fixed in 0.12.0
- CVE-2023-40026Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-serverGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.3.0
- CVE-2023-42818SSH public key login without private key challenge if mfa is enabled in jumpserverGo · github.com/jumpserver/jumpserver, github.com/jumpserver/koko · fixed in 3.5.6+incompatible, 3.6.5+incompatible
- CVE-2023-43651Remote code execution on the host system via MongoDB shell in jumpserverGo · github.com/jumpserver/koko · fixed in 2.28.20, 3.7.1
- CVE-2023-43645Denial of service from circular relationship definitions in OpenFGAGo · github.com/openfga/openfga · fixed in 1.3.2
- CVE-2023-41332Denial of service via Kubernetes annotations in specific Cilium configurationsGo · github.com/cilium/cilium · fixed in 1.14.2, 1.12.14, 1.13.7
- CVE-2023-41333Bypass of namespace restrictions in CiliumNetworkPolicy Go · github.com/cilium/cilium · fixed in 1.12.14, 1.13.7, 1.14.2
- CVE-2023-39347Cilium NetworkPolicy bypass via pod labelsGo · github.com/cilium/cilium · fixed in 1.12.14, 1.13.7, 1.14.2
- CVE-2022-4318Cri-o: /etc/passwd tampering privescGo · github.com/cri-o/cri-o · fixed in 1.26.0
- CVE-2023-43644Improper authentication in the SOCKS5 inbound in sing-boxGo · github.com/sagernet/sing, github.com/sagernet/sing-box · fixed in 0.2.12-0.20230925092853-5b05b5c147d9, 1.4.5, 1.5.0-rc.5
- CVE-2023-1260Kube-apiserver: privescGo · github.com/openshift/apiserver-library-go · fixed in 0.0.0-20230621
- CVE-2022-3962Kiali: error message spoofing in kiali uiGo · github.com/kiali/kiali · fixed in 1.57.4
- CVE-2023-42821github.com/gomarkdown/markdown Out-of-bounds Read while parsing citationsGo · github.com/gomarkdown/markdown · fixed in 0.0.0-20230922105210-14b16010c2ee
- CVE-2023-43637Vault Key Partially PredeterminedGo · github.com/lf-edge/eve · fixed in 0.0.0-20220310190112-c0c966dc31e2
- CVE-2023-43631SSH as Root Unlockable Without Triggering Measured BootGo · github.com/lf-edge/eve · fixed in 0.0.0-20220708121648-5fef4d92e758
- CVE-2023-43632Freely Allocate Buffer on The Stack With Data From SocketGo · github.com/lf-edge/eve · fixed in 0.0.0-20230519072751-977f42b07fa9
- CVE-2023-43633Debug Functions Unlockable Without Triggering Measured BootGo · github.com/lf-edge/eve · fixed in 0.0.0-20220708121648-5fef4d92e758
- CVE-2023-43634 Config Partition Not Protected by Measured BootGo · github.com/lf-edge/eve · fixed in 0.0.0-20230519072751-977f42b07fa9
- CVE-2023-37279Faktory Web Dashboard can lead to denial of service(DOS) via malicious user inputGo · github.com/contribsys/faktory · fixed in 1.8.0
- CVE-2023-43635Vault Key Sealed With SHA1 PCRsGo · github.com/lf-edge/eve · fixed in 0.0.0-20230519072751-977f42b07fa9
- CVE-2023-43636Rootfs Not ProtectedGo · github.com/lf-edge/eve, github.com/lf-edge/eve/pkg/grub · fixed in 0.0.0-20220708121648-5fef4d92e758
- CVE-2023-43630Config Partition Not Measured From 2 FrontsGo · github.com/lf-edge/eve · fixed in 0.0.0-20230126065759-d9383a7ee4e1
- CVE-2023-22644JWT token compromise can allow malicious actions including Remote Code Execution (RCE)Go · github.com/neuvector/neuvector · fixed in 0.0.0-20231003121714-be746957ee7c
- CVE-2023-43616An issue was discovered in Croc through 9.6.5.Go · github.com/schollz/croc, github.com/schollz/croc/v6 +2 · fixed in 9.6.16
- CVE-2023-43617An issue was discovered in Croc through 9.6.5.Go · github.com/schollz/croc, github.com/schollz/croc/v6 +2 · fixed in 9.6.16
- CVE-2023-43618An issue was discovered in Croc through 9.6.5.Go · github.com/schollz/croc, github.com/schollz/croc/v6 +2 · fixed in 9.6.16
- CVE-2023-43619An issue was discovered in Croc through 9.6.5.Go · github.com/schollz/croc, github.com/schollz/croc/v6 +2 · fixed in 9.6.16
- CVE-2023-43620An issue was discovered in Croc through 9.6.5.Go · github.com/schollz/croc, github.com/schollz/croc/v6 +2 · fixed in 9.6.16
- CVE-2023-43621An issue was discovered in Croc through 9.6.5.Go · github.com/schollz/croc, github.com/schollz/croc/v6 +2 · fixed in 9.6.16
- CVE-2023-32186A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supGo · github.com/rancher/rke2 · fixed in 1.24.17, 1.25.13, 1.26.8 and more