Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-32813Drop Headers via Malicious Connection HeaderGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 · fixed in 2.4.13
- CVE-2021-36156An issue was discovered in Grafana Loki through 2.2.1.Go · github.com/grafana/loki · fixed in 2.3.0
- CVE-2021-36157An issue was discovered in Grafana Cortex through 1.9.0.Go · github.com/cortexproject/cortex
- CVE-2021-37914In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is enabled and untrusted users are allowed to specify input parameters when runningGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +1 · fixed in 3.1.6
- CVE-2021-33198In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText methGo · stdlib · fixed in 1.15.13, 1.16.5
- CVE-2021-33197In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an aGo · stdlib · fixed in 1.15.13, 1.16.5
- CVE-2021-33195Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return vaGo · stdlib · fixed in 1.15.13, 1.16.5
- CVE-2021-33196In archive/zip in Go before 1.15.13 and 1.16.x before 1.16.5, a crafted file count (in an archive's header) can cause a NewReader or OpenReaGo · stdlib · fixed in 1.15.13, 1.16.5
- CVE-2021-32783Authorization bypass in ContourGo · github.com/projectcontour/contour · fixed in 1.14.2, 1.15.2, 1.16.1 and more
- CVE-2021-23409Denial of Service (DoS)Go · github.com/pires/go-proxyproto · fixed in 0.6.1
- CVE-2021-32760Archive package allows chmod of file outside of unpack target directoryGo · github.com/containerd/containerd · fixed in 1.4.8, 1.5.4
- CVE-2021-36213HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action canGo · github.com/hashicorp/consul · fixed in 1.10.1
- CVE-2021-32574HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in Go · github.com/hashicorp/consul · fixed in 1.10.1
- CVE-2021-34558The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expecteGo · stdlib · fixed in 1.15.14, 1.16.6
- CVE-2021-31999Rancher: Privilege escalation vulnerability via malicious Connection headerGo · github.com/rancher/rancher · fixed in 2.4.16, 2.5.9
- CVE-2021-25320Rancher: Cloud credentials can be used through proxy API by users without accessGo · github.com/rancher/rancher · fixed in 2.4.16, 2.5.9
- CVE-2021-25318rancher: API group not properly specified when creating Kubernetes RBAC resourcesGo · github.com/rancher/rancher · fixed in 2.4.16, 2.5.9
- CVE-2021-32721URL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermuxGo · github.com/andrewburian/powermux · fixed in 1.1.1
- CVE-2021-32701Possible bypass of token claim validation when OAuth2 Introspection caching is enabledGo · github.com/ory/oathkeeper · fixed in 0.38.12-beta.1
- CVE-2021-32699Asymmetric Resource Consumption (Amplification) in Docker containers created by WingsGo · github.com/pterodactyl/wings · fixed in 1.4.4
- CVE-2021-32575HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same nodGo · github.com/hashicorp/nomad · fixed in 0.12.12, 1.0.5
- CVE-2021-32690Repository credentials passed to alternate domainGo · helm.sh/helm/v3 · fixed in 3.6.1
- CVE-2021-20329Specific cstrings input may not be properly validated in the Go DriverGo · go.mongodb.org/mongo-driver · fixed in 1.5.1
- CVE-2021-32923HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those withiGo · github.com/hashicorp/vault · fixed in 1.7.2, 1.6.5, 1.5.9
- CVE-2021-3499A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewallGo · github.com/ovn-org/ovn-kubernetes
- CVE-2021-3538A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7Go · github.com/satori/go.uuid · fixed in 1.2.1-0.20180404165556-75cca531ea76
- CVE-2021-3495An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0 and before 1.24.7.Go · github.com/kiali/kiali · fixed in 1.33.0
- CVE-2021-32635Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote EndpointGo · github.com/sylabs/singularity · fixed in 3.7.4
- CVE-2021-32637Authentication bypassed with malformed request URIGo · github.com/authelia/authelia/v4 · fixed in 4.29.3
- CVE-2021-20278An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used.Go · github.com/kiali/kiali · fixed in 1.31.0