Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-30840On a compromised node, the fluid-csi service account can be used to modify node specsGo · github.com/fluid-cloudnative/fluid · fixed in 0.8.6
- CVE-2023-30551Rekor's compressed archives can result in OOM conditionsGo · github.com/sigstore/rekor · fixed in 1.1.1
- CVE-2023-30019imgproxy <=3.14.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.Go · github.com/imgproxy/imgproxy, github.com/imgproxy/imgproxy/v2 +1 · fixed in 3.15.0
- CVE-2023-29659A Segmentation fault caused by a floating point exception exists in libheif 1.15.1 using crafted heif images via the heif::Fraction::round()Go · github.com/strukturag/libheif · fixed in 1.15.2
- CVE-2023-22651Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation.Go · github.com/rancher/rancher · fixed in 2.7.3, 0.0.0-20230424183121-6d9a175954c6
- CVE-2023-26125Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a sGo · github.com/gin-gonic/gin · fixed in 1.9.0
- CVE-2023-30841Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMapsGo · github.com/metal3-io/baremetal-operator · fixed in 0.3.0
- CVE-2023-30549Unpatched extfs vulnerabilities are exploitable through suid-mode ApptainerGo · github.com/apptainer/apptainer · fixed in 1.1.8
- CVE-2023-26494lorawan-stack has open redirect vulnerabilityGo · go.thethings.network/lorawan-stack, go.thethings.network/lorawan-stack/v3 · fixed in 3.24.1
- CVE-2023-30622Clusternet has potential risk which can be leveraged to make a cluster-level privilege escalationGo · github.com/clusternet/clusternet · fixed in 0.15.2
- CVE-2022-47930An issue was discovered in IO FinNet tss-lib before 2.0.0.Go · github.com/binance-chain/tss-lib, github.com/bnb-chain/tss-lib · fixed in 2.0.0
- CVE-2023-26556io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implemeGo · github.com/binance-chain/tss-lib, github.com/bnb-chain/tss-lib · fixed in 2.0.0, 1.3.6-0.20230324145555-bb6fb30bd3eb
- CVE-2023-26557io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, Go · github.com/binance-chain/tss-lib, github.com/bnb-chain/tss-lib · fixed in 1.3.6-0.20230324145555-bb6fb30bd3eb
- CVE-2023-29002Debug mode leaks confidential data in CiliumGo · github.com/cilium/cilium · fixed in 1.11.16, 1.12.9, 1.13.2
- CVE-2023-29193SpiceDB binding metrics port to untrusted networks and can leak command-line flagsGo · github.com/authzed/spicedb · fixed in 1.19.1
- CVE-2023-29018 OpenFeature Operator vulnerable to Cluster-level Privilege EscalationGo · github.com/open-feature/open-feature-operator · fixed in 0.2.32
- CVE-2023-29194vitess allows users to create keyspaces that can deny access to already existing keyspacesGo · vitess.io/vitess · fixed in 0.16.1
- CVE-2023-29013HTTP header parsing could cause a deny of serviceGo · github.com/traefik/traefik/v2 · fixed in 2.9.10, 2.10.0-rc2
- CVE-2023-30512CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation.Go · github.com/cubefs/cubefs
- CVE-2023-1974Exposure of Sensitive Information Through Metadata in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.8
- CVE-2023-1975Insertion of Sensitive Information Into Sent Data in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.8
- CVE-2023-1976Password Aging with Long Expiration in answerdev/answerGo · github.com/answerdev/answer · fixed in 1.0.6
- CVE-2023-24537Infinite loop in parsing in go/scannerGo · stdlib · fixed in 1.19.8, 1.20.3
- CVE-2023-24538Backticks not treated as string delimiters in html/templateGo · stdlib · fixed in 1.19.8, 1.20.3
- CVE-2023-24534Excessive memory allocation in net/http and net/textprotoGo · stdlib · fixed in 1.19.8, 1.20.3
- CVE-2023-24536Excessive resource consumption in net/http, net/textproto and mime/multipartGo · stdlib · fixed in 1.19.8, 1.20.3
- CVE-2023-1782Nomad Unauthenticated Client Agent HTTP Request Privilege EscalationGo · github.com/hashicorp/nomad · fixed in 1.5.3
- CVE-2023-28840moby/moby's dockerd daemon encrypted overlay network may be unauthenticatedGo · github.com/docker/docker · fixed in 20.10.24, 23.0.3, 20.10.24+incompatible and more
- CVE-2023-28841moby/moby's dockerd daemon encrypted overlay network traffic may be unencryptedGo · github.com/docker/docker · fixed in 20.10.24+incompatible, 23.0.3+incompatible, 20.10.24 and more
- CVE-2023-28842moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticatedGo · github.com/docker/docker · fixed in 20.10.24+incompatible, 23.0.3+incompatible, 20.10.24 and more