Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-5415Concourse's GitLab auth allows impersonationGo · github.com/concourse/concourse, github.com/concourse/dex · fixed in 6.4.1, 6.3.1, 0.0.0-20200730151558-b00d1c8d8576 and more
- CVE-2020-8911CBC padding oracle in AWS S3 Crypto SDK for GoLangGo · github.com/aws/aws-sdk-go · fixed in 1.34.0
- CVE-2020-8912In-band key negotiation issue in AWS S3 Crypto SDK for GoLangGo · github.com/aws/aws-sdk-go · fixed in 1.34.0
- CVE-2020-8918TPM 1.2 key authorization values are vulnerable to a TPM transport eavesdropperGo · github.com/google/go-tpm · fixed in 0.3.0
- CVE-2020-15136Improper authentication in etcdGo · go.etcd.io/etcd · fixed in 3.4.10, 3.3.23
- CVE-2020-15114Denial of Service in etcdGo · go.etcd.io/etcd · fixed in 3.4.10, 3.3.23
- CVE-2020-15115No minimum password length in etcdGo · go.etcd.io/etcd/client/v3 · fixed in 3.4.10, 3.3.23
- CVE-2020-16845Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.Go · stdlib · fixed in 1.13.15, 1.14.7
- CVE-2020-15112Improper Input Validation in etcdGo · go.etcd.io/etcd, go.etcd.io/etcd/v3 · fixed in 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4, 3.3.23, 3.4.10
- CVE-2020-15113Improper Preservation of Permissions in etcdGo · github.com/etcd-io/etcd · fixed in 3.4.10, 3.3.23
- CVE-2020-15106Improper Input Validation in etcdGo · go.etcd.io/etcd, go.etcd.io/etcd/v3 · fixed in 0.5.0-alpha.5.0.20200423152442-f4b650b51dc4, 3.3.23, 3.4.10
- CVE-2020-15129Open redirect in TraefikGo · github.com/containous/traefik, github.com/containous/traefik/api +6 · fixed in 1.7.26, 2.2.8, 2.3.0-rc3 and more
- CVE-2020-14316A flaw was found in kubevirt 0.29 and earlier.Go · kubevirt.io/kubevirt · fixed in 0.30.0
- CVE-2020-8553Kubernetes ingress-nginx Compromise of auth via subset/superset namespace namesGo · k8s.io/ingress-nginx · fixed in 0.28.0
- CVE-2020-8558Kubernetes node setting allows for neighboring hosts to bypass localhost boundaryGo · k8s.io/kubernetes · fixed in 1.18.4, 1.17.7, 1.16.11
- CVE-2020-11110Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field, which allows an attacker to inject JaGo · github.com/grafana/grafana · fixed in 6.7.2
- CVE-2020-15391The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WeGo · github.com/loft-sh/devspace · fixed in 4.14.0
- CVE-2020-8557Kubernetes node disk Denial of Service by writing to container /etc/hostsGo · k8s.io/kubernetes, k8s.io/kubernetes/pkg/kubelet · fixed in 1.16.13, 1.17.9, 1.18.6
- CVE-2020-8559Privilege escalation from compromised node to clusterGo · k8s.io/apimachinery, k8s.io/kubernetes · fixed in 0.16.13, 0.17.9, 0.18.7-rc.0 and more
- CVE-2020-15111CRLF vulnerability in FiberGo · github.com/gofiber/fiber · fixed in 1.12.6
- CVE-2020-14039In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements (if VerifGo · stdlib · fixed in 1.13.13, 1.14.5
- CVE-2020-15586Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, bGo · stdlib · fixed in 1.13.13, 1.14.5
- CVE-2020-13788Harbor prior to 2.0.1 allows SSRF with this limitation: an attacker with the ability to edit projects can scan ports of hosts accessible on Go · github.com/goharbor/harbor · fixed in 2.0.1+incompatible, 2.0.1
- CVE-2020-13846Sylabs Singularity 3.5.0 through 3.5.3 fails to report an error in a Status Code.Go · github.com/sylabs/singularity · fixed in 3.6.0
- CVE-2020-13845Sylabs Singularity 3.0 through 3.5 has Improper Validation of an Integrity Check Value.Go · github.com/sylabs/singularity · fixed in 3.6.0
- CVE-2020-15091Denial of Service in TenderMintGo · github.com/tendermint/tendermint · fixed in 0.34.0-dev1.0.20200702134149-480b995a3172, 0.33.6
- CVE-2019-20894Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLGo · github.com/containous/traefik, github.com/containous/traefik/v2 +1 · fixed in 2.2.2
- CVE-2020-4037Open Redirect in OAuth2 ProxyGo · github.com/oauth2-proxy/oauth2-proxy · fixed in 6.0.0
- CVE-2020-7667Arbitrary File Write via Archive Extraction (Zip Slip)Go · github.com/sassoftware/go-rpmutils · fixed in 0.1.0
- CVE-2020-14958In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.Go · gogs.io/gogs · fixed in 0.12.0