Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-39226Snapshot authentication bypass in grafanaGo · github.com/grafana/grafana · fixed in 7.5.11, 8.1.6
- CVE-2021-41089`docker cp` allows unexpected chmod of host filesGo · github.com/docker/docker, github.com/moby/moby · fixed in 20.10.9+incompatible, 20.10.9
- CVE-2021-41091Insufficiently restricted permissions on data directory in Docker EngineGo · github.com/docker/docker, github.com/moby/moby · fixed in 20.10.9+incompatible, 20.10.9
- CVE-2021-41092Docker CLI leaks private registry credentials to registry-1.docker.ioGo · github.com/docker/cli · fixed in 20.10.9, 20.10.9+incompatible
- CVE-2021-41103Insufficiently restricted permissions on plugin directoriesGo · github.com/containerd/containerd · fixed in 1.4.11, 1.5.7
- CVE-2021-41088Remote code execution via the web UI backend of ElvishGo · github.com/elves/elvish · fixed in 0.14.0
- CVE-2021-37860Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary webGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 · fixed in 5.39.0
- CVE-2021-41087Improperly Implemented path matching for in-toto-golangGo · github.com/in-toto/in-toto-golang · fixed in 0.3.0
- CVE-2021-25741Symlink Exchange Can Allow Host Filesystem AccessGo · k8s.io/kubernetes · fixed in 1.19.15, 1.20.11, 1.21.5 and more
- CVE-2021-25740Holes in EndpointSlice Validation Enable Host Network HijackGo · k8s.io/kubernetes
- CVE-2020-8561Webhook redirect in kube-apiserverGo · k8s.io/kubernetes
- CVE-2021-39391Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated bGo · github.com/beego/beego/v2 · fixed in 2.0.2
- CVE-2021-39206Incorrect Authorization with specially crafted requestsGo · github.com/pomerium/pomerium · fixed in 0.14.8, 0.15.1
- CVE-2021-39204Excessive CPU usage in PomeriumGo · github.com/pomerium/pomerium · fixed in 0.14.8, 0.15.1
- CVE-2021-39162Incorrect handling of H2 GOAWAY + SETTINGS framesGo · github.com/pomerium/pomerium · fixed in 0.15.1
- CVE-2021-3761OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength valuesGo · github.com/cloudflare/cfrpki · fixed in 1.3.0
- CVE-2021-38698HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access toGo · github.com/hashicorp/consul · fixed in 1.10.2, 1.9.9, 1.8.15
- CVE-2021-37218HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access serverGo · github.com/hashicorp/nomad · fixed in 1.0.10, 1.1.4
- CVE-2021-37219HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to acceGo · github.com/hashicorp/consul · fixed in 1.8.15, 1.9.9, 1.10.2
- CVE-2021-25737Holes in EndpointSlice Validation Enable Host Network HijackGo · k8s.io/kubernetes · fixed in 1.18.19, 1.19.11, 1.20.7 and more
- CVE-2021-25735Validating Admission Webhook does not observe some previous fieldsGo · k8s.io/kubernetes · fixed in 1.20.6, 1.19.10, 1.18.18
- CVE-2021-39156Fragments in Path May Lead to Authorization Policy BypassGo · istio.io/istio · fixed in 1.9.8, 1.10.4, 1.11.1
- CVE-2021-39155Authorization Policy Bypass Due to Case Insensitive Host ComparisonGo · istio.io/istio · fixed in 1.9.8, 1.10.4, 1.11.1
- CVE-2021-39137Consensus flaw during block processing in go-ethereumGo · github.com/ethereum/go-ethereum · fixed in 1.10.8
- CVE-2021-38553HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage featGo · github.com/hashicorp/vault · fixed in 1.8.0
- CVE-2021-38554HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser.Go · github.com/hashicorp/vault · fixed in 1.6.6, 1.7.4
- CVE-2021-38599WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignoGo · github.com/wal-g/wal-g · fixed in 1.1
- CVE-2021-21501ServiceComb ServiceCenter Directory TraversalGo · github.com/apache/servicecomb-service-center · fixed in 2.0.0
- CVE-2021-38197unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.Go · github.com/gen2brain/go-unarr · fixed in 0.1.4
- CVE-2021-36221Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandGo · stdlib · fixed in 1.15.15, 1.16.7