Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-17522When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files includeGo · github.com/apache/trafficcontrol · fixed in 5.0.0
- CVE-2021-3114In Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect outputs, related to an underflow of the lowestGo · stdlib · fixed in 1.14.14, 1.15.7
- CVE-2021-3115Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" cGo · toolchain · fixed in 1.14.14, 1.15.7
- CVE-2021-21272zip slip in ORASGo · github.com/deislabs/oras · fixed in 0.9.0
- CVE-2020-8569Kubernetes CSI snapshot-controller DoSGo · github.com/kubernetes-csi/external-snapshotter/v2, github.com/kubernetes-csi/external-snapshotter/v3 · fixed in 2.1.3, 3.0.2
- CVE-2020-8568Kubernetes Secrets Store CSI Driver sync/rotate directory traversalGo · sigs.k8s.io/secrets-store-csi-driver · fixed in 0.0.17
- CVE-2020-8567Kubernetes Secrets Store CSI Driver plugin directory traversalsGo · github.com/azure/secrets-store-csi-driver-provider-azure, github.com/googlecloudplatform/secrets-store-csi-driver-provider-gcp +1 · fixed in 0.0.10, 0.2.0, 0.0.6
- CVE-2020-8554Kubernetes man in the middle using LoadBalancer or ExternalIPsGo · k8s.io/kubernetes
- CVE-2020-28483HTTP Response SplittingGo · github.com/gin-gonic/gin · fixed in 1.7.7
- CVE-2021-21237Git LFS can execute a Git binary from the current directory on WindowsGo · github.com/git-lfs/git-lfs · fixed in 2.13.2, 1.5.1-0.20210113180018-fc664697ed2c
- CVE-2021-3121An issue was discovered in GoGo Protobuf before 1.3.2.Go · github.com/gogo/protobuf · fixed in 1.3.2
- CVE-2020-36066GJSON <1.6.5 allows attackers to cause a denial of service (remote) via crafted JSON.Go · github.com/tidwall/gjson · fixed in 1.6.5
- CVE-2020-36067GJSON <=v1.6.5 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a crafted GET call.Go · github.com/tidwall/gjson · fixed in 1.6.6
- CVE-2020-26294Exposure of server configurationGo · github.com/go-vela/compiler · fixed in 0.6.1
- CVE-2020-27534util/binfmt_misc/check.go in Builder in Docker Engine before 19.03.9 calls os.OpenFile with a potentially unsafe qemu-check temporary pathnaGo · github.com/docker/docker, github.com/moby/moby · fixed in 19.03.9
- CVE-2020-26290Critical security issues in XML encoding in DexGo · github.com/dexidp/dex, github.com/russellhaering/goxmldsig · fixed in 2.27.0, 1.1.0
- CVE-2020-29245dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readAtomData.Go · github.com/dhowden/tag · fixed in 0.0.0-20201120070457-d52dcb253c63
- CVE-2020-29244dhowden tag before 2020-11-19 allows "panic: runtime error: slice bounds out of range" via readTextWithDescrFrame.Go · github.com/dhowden/tag · fixed in 0.0.0-20201120070457-d52dcb253c63
- CVE-2020-29243dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readAPICFrame.Go · github.com/dhowden/tag · fixed in 0.0.0-20201120070457-d52dcb253c63
- CVE-2020-29242dhowden tag before 2020-11-19 allows "panic: runtime error: index out of range" via readPICFrame.Go · github.com/dhowden/tag · fixed in 0.0.0-20201120070457-d52dcb253c63
- CVE-2020-26284Hugo can execute a binary from the current directory on WindowsGo · github.com/gohugoio/hugo · fixed in 0.79.1
- CVE-2020-26277Arbitrary read/write in DBdeployerGo · github.com/datacharmer/dbdeployer · fixed in 1.58.2
- CVE-2020-27846A signature verification vulnerability exists in crewjam/saml.Go · github.com/crewjam/saml · fixed in 0.4.3
- CVE-2020-26276SAML authentication vulnerability in FleetGo · github.com/fleetdm/fleet/v4 · fixed in 3.5.1
- CVE-2020-35177HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method.Go · github.com/hashicorp/vault · fixed in 1.5.6, 1.6.1
- CVE-2020-29652A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackersGo · golang.org/x/crypto · fixed in 0.0.0-20201216223049-8b5274cf687f
- CVE-2020-35381jsonparser 1.0.0 allows attackers to cause a denial of service (panic: runtime error: slice bounds out of range) via a GET call.Go · github.com/buger/jsonparser · fixed in 1.1.1
- CVE-2020-35380GJSON before 1.6.4 allows attackers to cause a denial of service via crafted JSON.Go · github.com/tidwall/gjson · fixed in 1.6.4
- CVE-2020-29509The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization Go · github.com/russellhaering/gosaml2 · fixed in 0.6.0
- CVE-2020-26264LES Server DoS via GetProofsV2Go · github.com/ethereum/go-ethereum · fixed in 1.9.25