Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-30324HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation throGo · github.com/hashicorp/nomad · fixed in 1.1.14, 1.2.8, 1.3.1
- CVE-2022-29637An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file.Go · github.com/mindoc-org/mindoc
- CVE-2022-30427In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal.Go · github.com/gphper/ginadmin
- CVE-2022-30428In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading.Go · github.com/gphper/ginadmin
- CVE-2022-26945go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response heGo · github.com/hashicorp/go-getter, github.com/hashicorp/go-getter/gcs/v2 +2 · fixed in 1.6.1, 2.1.0
- CVE-2022-30321go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flawsGo · github.com/hashicorp/go-getter, github.com/hashicorp/go-getter/gcs/v2 +2 · fixed in 1.6.1, 2.1.0
- CVE-2022-30322go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses.Go · github.com/hashicorp/go-getter, github.com/hashicorp/go-getter/gcs/v2 +2 · fixed in 1.6.1, 2.1.0
- CVE-2022-30323go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files.Go · github.com/hashicorp/go-getter, github.com/hashicorp/go-getter/gcs/v2 +2 · fixed in 1.6.1, 2.1.0
- CVE-2022-21951Rancher: Weave CNI password is not set if RKE template is used with CNI value overriddenGo · github.com/rancher/rancher · fixed in 2.6.5, 2.5.14
- CVE-2022-29222Improper Certificate Validation in Pion DTLSGo · github.com/pion/dtls, github.com/pion/dtls/v2 · fixed in 2.1.5
- CVE-2022-31259The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control.Go · github.com/astaxie/beego, github.com/beego/beego +1 · fixed in 1.12.9, 2.0.3
- CVE-2022-29189Buffer for inbound DTLS fragments has no limitGo · github.com/pion/dtls, github.com/pion/dtls/v2 · fixed in 2.1.4
- CVE-2022-29190Header reconstruction method can be thrown into an infinite loop in Pion DTLSGo · github.com/pion/dtls, github.com/pion/dtls/v2 · fixed in 2.1.4
- CVE-2022-29188Smokescreen SSRF via deny list bypass (square brackets) in SmokescreenGo · github.com/stripe/smokescreen · fixed in 0.0.4
- CVE-2022-29179Improper Privilege Management in CiliumGo · github.com/cilium/cilium · fixed in 1.9.16, 1.10.11, 1.11.5
- CVE-2022-29178Incorrect Default Permissions in CiliumGo · github.com/cilium/cilium · fixed in 1.9.16, 1.10.11, 1.11.5
- CVE-2022-29177DoS via malicious p2p message in Go-EthereumGo · github.com/ethereum/go-ethereum · fixed in 1.10.17
- CVE-2022-29165Argo CD will blindly trust JWT claims if anonymous access is enabledGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.15, 2.3.4, 2.2.9
- CVE-2022-24905Argo CD login screen allows message spoofing if SSO is enabledGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.15, 2.2.9, 2.3.4
- CVE-2022-24904Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-serverGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.1.15, 2.2.9, 2.3.4
- CVE-2022-28948An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.Go · gopkg.in/yaml.v3 · fixed in 3.0.1, 3.0.0-20220521103104-8f96da9f5d5e
- CVE-2022-28946An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causiGo · github.com/open-policy-agent/opa · fixed in 0.40.0
- CVE-2022-30689HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts.Go · github.com/hashicorp/vault · fixed in 1.10.3
- CVE-2022-1706A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products.Go · github.com/coreos/ignition, github.com/coreos/ignition/v2 · fixed in 2.14.0
- CVE-2022-29162Incorrect Default Permissions in runcGo · github.com/opencontainers/runc · fixed in 1.1.2
- CVE-2022-30781Gitea before 1.16.7 does not escape git fetch remote.Go · code.gitea.io/gitea · fixed in 1.16.7
- CVE-2022-29180Charm vulnerable to server-side request forgery (SSRF)Go · github.com/charmbracelet/charm · fixed in 0.12.1
- CVE-2022-24878Improper path handling in Kustomization files allows for denial of serviceGo · github.com/fluxcd/flux2, github.com/fluxcd/kustomize-controller · fixed in 0.29.0, 0.24.0
- CVE-2022-24877Improper path handling in kustomization files allows path traversalGo · github.com/fluxcd/flux2, github.com/fluxcd/kustomize-controller · fixed in 0.29.0, 0.24.0
- CVE-2021-25745Ingress-nginx path can be pointed to service account token fileGo · k8s.io/ingress-nginx · fixed in 1.2.0