Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-43415HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with jobGo · github.com/hashicorp/nomad · fixed in 1.0.14, 1.1.8, 1.2.1
- CVE-2021-43998HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and 1.8.4 templated ACL policies would always match the first-created entity alias iGo · github.com/hashicorp/vault · fixed in 1.7.6, 1.8.5
- CVE-2021-20848Cross-site scripting vulnerability in rwtxt versions prior to v1.8.6 allows a remote attacker to inject an arbitrary script via unspecified Go · github.com/schollz/rwtxt · fixed in 1.8.6
- CVE-2021-41278Broken encryption in app-functions-sdk “AES” transform in EdgeX Foundry releases prior to Jakarta allows attackers to decrypt messages via unspecified vectorsGo · github.com/edgexfoundry/app-functions-sdk-go, github.com/edgexfoundry/app-functions-sdk-go/v2 +1 · fixed in 2.1.0
- CVE-2021-43669A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0.Go · github.com/hyperledger/fabric · fixed in 2.4.0
- CVE-2021-43668Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered.Go · github.com/ethereum/go-ethereum
- CVE-2021-43667A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0.Go · github.com/hyperledger/fabric · fixed in 2.3.3, 2.2.4
- CVE-2021-41190Clarify Content-Type handling in OCI specGo · github.com/opencontainers/distribution-spec · fixed in 1.0.1
- CVE-2021-41266Authentication bypass issue in the Operator ConsoleGo · github.com/minio/console · fixed in 0.12.3
- CVE-2021-41244Cross organization admin control in GrafanaGo · github.com/grafana/grafana · fixed in 8.2.4
- CVE-2021-41254Privilege escalation to cluster admin on multi-tenant environmentsGo · github.com/fluxcd/kustomize-controller · fixed in 0.15.0
- CVE-2021-3912OctoRPKI crashes when processing GZIP bomb returned via malicious repositoryGo · github.com/cloudflare/cfrpki · fixed in 1.4.0
- CVE-2021-3911Misconfigured IP address field in ROA leads to OctoRPKI crashGo · github.com/cloudflare/cfrpki · fixed in 1.4.0
- CVE-2021-3910NUL character in ROA causes OctoRPKI to crashGo · github.com/cloudflare/cfrpki · fixed in 1.4.0
- CVE-2021-3909Infinite open connection causes OctoRPKI to hang foreverGo · github.com/cloudflare/cfrpki · fixed in 1.4.0
- CVE-2021-3908Infinite certificate chain depth results in OctoRPKI running foreverGo · github.com/cloudflare/cfrpki · fixed in 1.4.0
- CVE-2021-3907Arbitrary filepath traversal via URI injectionGo · github.com/cloudflare/cfrpki · fixed in 1.4.3, 1.4.4
- CVE-2021-43350LDAP filter injection vulnerability in Traffic OpsGo · github.com/apache/trafficcontrol · fixed in 5.1.4+incompatible, 6.0.1+incompatible, 6.0.1 and more
- CVE-2021-41771ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End Go · stdlib · fixed in 1.16.10, 1.17.3
- CVE-2021-41772Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or aGo · stdlib · fixed in 1.16.10, 1.17.3
- CVE-2021-41230OIDC claims not updated from Identity Provider in PomeriumGo · github.com/pomerium/pomerium · fixed in 0.15.6
- CVE-2021-41232Improper Neutralization of Special Elements used in an LDAP QueryGo · github.com/stevenweathers/thunderdome-planning-poker · fixed in 1.16.3
- CVE-2021-41173DoS via maliciously crafted p2p messageGo · github.com/ethereum/go-ethereum · fixed in 1.10.9
- CVE-2021-42836GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.Go · github.com/tidwall/gjson · fixed in 1.9.3
- CVE-2021-41135Authz Module Non-DeterminismGo · github.com/cosmos/cosmos-sdk · fixed in 0.44.2
- CVE-2021-42576The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated Go · github.com/microcosm-cc/bluemonday · fixed in 1.0.16
- CVE-2021-38297Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCHGo · toolchain · fixed in 1.16.9, 1.17.2
- CVE-2021-42009Apache Traffic Control Traffic Ops Email Injection VulnerabilityGo · github.com/apache/trafficcontrol · fixed in 5.1.3+incompatible, 5.1.3
- CVE-2021-42135HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google CloGo · github.com/hashicorp/vault · fixed in 1.8.5
- CVE-2021-41802HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount acceGo · github.com/hashicorp/vault · fixed in 1.7.5, 1.8.4