Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-36085OPA Compiler: Bypass of WithUnsafeBuiltins using `with` keyword to mock functionsGo · github.com/open-policy-agent/opa · fixed in 0.44.0, 0.43.1
- CVE-2022-36049Flux2 Helm Controller denial of serviceGo · github.com/fluxcd/flux2, github.com/fluxcd/helm-controller · fixed in 0.32.0, 0.23.0
- CVE-2022-31247Rancher: Downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)Go · github.com/rancher/rancher · fixed in 2.5.16, 2.6.7
- CVE-2021-36783Rancher: Failure to properly sanitize credentials in cluster template answersGo · github.com/rancher/rancher · fixed in 2.5.13, 2.6.4
- CVE-2021-36782Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io objectGo · github.com/rancher/rancher · fixed in 2.5.16, 2.6.7
- CVE-2022-36061Elrond go can execute on same context checks in VMGo · github.com/elrondnetwork/elrond-go · fixed in 1.3.35
- CVE-2022-36058elrond-go MultiESDTNFTTransfer call on a SC address with missing function nameGo · github.com/elrondnetwork/elrond-go · fixed in 1.3.34
- CVE-2022-27664In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang duriGo · golang.org/x/net, golang.org/x/net/http2 +1 · fixed in 0.0.0-20220906165146-f3363e06e74c, 1.18.6, 1.19.1
- CVE-2021-43565The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.Go · golang.org/x/crypto · fixed in 0.0.0-20211202192323-5770296d904e
- CVE-2022-36071Recovery codes abuse in SFTPGoGo · github.com/drakkan/sftpgo, github.com/drakkan/sftpgo/v2 · fixed in 2.3.4
- CVE-2022-36078Slice Memory Allocation with Excessive Size Value in binaryGo · github.com/gagliardetto/binary · fixed in 0.7.1
- CVE-2022-36055Denial of service in HelmGo · helm.sh/helm/v3 · fixed in 3.9.4
- CVE-2022-36051Broken Authorization in ZITADEL ActionsGo · github.com/zitadel/zitadel · fixed in 2.2.0, 1.87.1
- CVE-2022-36035Flux CLI Workload InjectionGo · github.com/fluxcd/flux2 · fixed in 0.32.0
- CVE-2022-31677An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0).Go · go.pinniped.dev · fixed in 0.19.0
- CVE-2022-36633Teleport 9.3.6 is vulnerable to Command injection leading to Remote Code Execution.Go · github.com/gravitational/teleport · fixed in 8.3.17, 9.3.13, 10.1.2
- CVE-2022-36009Incorrect parsing of access level in gomatrixserverlib and dendriteGo · github.com/matrix-org/dendrite, github.com/matrix-org/gomatrixserverlib · fixed in 0.9.3, 0.0.0-20220815091947-723fd495dde8
- CVE-2022-36023Remote denial of service in Hyperledger Fabric GatewayGo · github.com/hyperledger/fabric · fixed in 2.4.6
- CVE-2022-38149HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.TGo · github.com/hashicorp/consul-template · fixed in 0.27.3, 0.28.3, 0.29.2
- CVE-2022-38183In Gitea before 1.16.9, it was possible for users to add existing issues to projects.Go · code.gitea.io/gitea · fixed in 1.16.9
- CVE-2022-32148Exposure of client IP addresses in net/httpGo · stdlib · fixed in 1.17.12, 1.18.4
- CVE-2022-1962Stack exhaustion due to deeply nested types in go/parserGo · stdlib · fixed in 1.17.12, 1.18.4
- CVE-2022-30580Empty Cmd.Path can trigger unintended binary in os/exec on WindowsGo · stdlib · fixed in 1.17.11, 1.18.3
- CVE-2022-32189Panic when decoding Float and Rat types in math/bigGo · stdlib · fixed in 1.17.13, 1.18.5
- CVE-2022-30629Session tickets lack random ticket_age_add in crypto/tlsGo · stdlib · fixed in 1.17.11, 1.18.3
- CVE-2022-30630Stack exhaustion in Glob on certain paths in io/fsGo · stdlib · fixed in 1.17.12, 1.18.4
- CVE-2022-1705Improper sanitization of Transfer-Encoding headers in net/httpGo · stdlib · fixed in 1.17.12, 1.18.4
- CVE-2022-30631Stack exhaustion when reading certain archives in compress/gzipGo · stdlib · fixed in 1.17.12, 1.18.4
- CVE-2022-30633Stack exhaustion when unmarshaling certain documents in encoding/xmlGo · stdlib · fixed in 1.17.12, 1.18.4
- CVE-2022-30635Stack exhaustion when decoding certain messages in encoding/gobGo · stdlib · fixed in 1.17.12, 1.18.4