Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-26265Consensus flaw during block processingGo · github.com/ethereum/go-ethereum · fixed in 1.9.20
- CVE-2020-8563Secret leaks in logs for vSphere Provider kube-controller-managerGo · github.com/kubernetes/kubernetes, k8s.io/kubernetes · fixed in 1.19.3
- CVE-2020-8564Docker config secrets leaked when file is malformed and loglevel >= 4Go · github.com/kubernetes/kubernetes, k8s.io/kubernetes · fixed in 1.19.3, 1.18.10, 1.17.13 and more
- CVE-2020-8565Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9Go · k8s.io/client-go, k8s.io/kubernetes · fixed in 0.20.0-alpha.2, 0.19.6, 0.18.14 and more
- CVE-2020-8566Ceph RBD adminSecrets exposed in logs when loglevel >= 4Go · github.com/kubernetes/kubernetes, k8s.io/kubernetes · fixed in 1.17.13, 1.18.10, 1.19.3
- CVE-2020-29529HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypasGo · github.com/hashicorp/go-slug · fixed in 0.5.0
- CVE-2020-27813An integer overflow vulnerability exists with the length of websocket frames received via a websocket connection.Go · github.com/gorilla/websocket · fixed in 1.4.1
- CVE-2020-15257containerd-shim API Exposed to Host Network ContainersGo · github.com/containerd/containerd · fixed in 1.3.9, 1.4.3
- CVE-2020-26240Erroneous Proof of Work calculation in gethGo · github.com/ethereum/go-ethereum · fixed in 1.9.24
- CVE-2020-26241Shallow copy bug in gethGo · github.com/ethereum/go-ethereum · fixed in 1.9.17
- CVE-2020-26242Denial of service in gethGo · github.com/ethereum/go-ethereum, github.com/holiman/uint256 · fixed in 1.9.18, 1.1.1
- CVE-2020-10763An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information.Go · github.com/heketi/heketi · fixed in 10.1.0
- CVE-2020-28348HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or Go · github.com/hashicorp/nomad · fixed in 0.10.8, 0.11.7, 0.12.8
- CVE-2020-28991Gitea 0.9.99 through 1.12.x before 1.12.6 does not prevent a git protocol path that specifies a TCP port number and also contains newlines (Go · github.com/go-gitea/gitea · fixed in 1.12.6
- CVE-2020-28053HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA privateGo · github.com/hashicorp/consul · fixed in 1.6.10, 1.7.10, 1.8.6
- CVE-2020-28924An issue was discovered in Rclone before 1.53.3.Go · github.com/rclone/rclone · fixed in 1.53.3
- CVE-2019-20933InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT tokGo · github.com/influxdata/influxdb · fixed in 1.7.6
- CVE-2020-28362Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.Go · stdlib · fixed in 1.14.12, 1.15.5
- CVE-2020-28366Arbitrary code execution in go command with cgo in cmd/go and cmd/cgoGo · toolchain · fixed in 1.14.12, 1.15.5
- CVE-2020-28367Arbitrary code execution via the go command with cgo in cmd/goGo · toolchain · fixed in 1.14.12, 1.15.5
- CVE-2020-26213Denial of Service in telerGo · ktbs.dev/teler · fixed in 0.0.1
- CVE-2020-26892The JWT library in NATS nats-server before 2.1.9 has Incorrect Access Control because of how expired credentials are handled.Go · github.com/nats-io/jwt, github.com/nats-io/nats-server/v2 · fixed in 1.1.0, 2.1.9
- CVE-2020-26521The JWT library in NATS nats-server before 2.1.9 allows a denial of service (a nil dereference in Go code).Go · github.com/nats-io/jwt, github.com/nats-io/nats-server/v2 · fixed in 1.1.0, 2.1.9
- CVE-2020-27955Git LFS 2.12.0 allows Remote Code Execution.Go · github.com/git-lfs/git-lfs · fixed in 2.12.1
- CVE-2020-25201HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of serviceGo · github.com/hashicorp/consul · fixed in 1.7.9, 1.8.5
- CVE-2020-10937An issue was discovered in IPFS (aka go-ipfs) 0.4.23.Go · github.com/ipfs/go-ipfs · fixed in 0.7.0
- CVE-2020-24710Gophish before 0.11.0 allows SSRF attacks.Go · github.com/gophish/gophish · fixed in 0.11.0
- CVE-2020-24303Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.Go · github.com/grafana/grafana · fixed in 7.1.0-beta1
- CVE-2020-27195HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or arGo · github.com/hashicorp/nomad · fixed in 0.10.6, 0.11.5, 0.12.6
- CVE-2020-15157containerd can be coerced into leaking credentials during image pullGo · github.com/containerd/containerd · fixed in 1.2.14