Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-9321configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers beforeGo · github.com/containous/traefik, github.com/containous/traefik/v2 +1 · fixed in 2.1.4
- CVE-2018-17572InfluxDB 0.9.5 has Reflected XSS in the Write Data module.Go · github.com/influxdata/influxdb · fixed in 0.9.6
- CVE-2020-9283golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/cryptoGo · golang.org/x/crypto · fixed in 0.0.0-20200220183623-bac4c82f6975
- CVE-2020-8945The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by DockeGo · github.com/proglottis/gpgme · fixed in 0.1.1
- CVE-2019-19921runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.Go · github.com/opencontainers/runc · fixed in 1.0.0-rc9.0.20200122160610-2fc03cc11c77
- CVE-2020-1726A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they areGo · github.com/containers/libpod, github.com/containers/libpod/v2 +2 · fixed in 2.0.6
- CVE-2015-5741The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduGo · stdlib · fixed in 1.4.3
- CVE-2019-11251kubectl cp allows symlink directory traversalGo · k8s.io/kubernetes · fixed in 1.13.11, 1.14.7, 1.16.0
- CVE-2019-12999Lightning Network Daemon (lnd) before 0.7 allows attackers to trigger loss of funds because of Incorrect Access Control.Go · github.com/lightningnetwork/lnd · fixed in 0.7.1-beta
- CVE-2020-7956HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and Go · github.com/hashicorp/nomad · fixed in 0.10.3
- CVE-2020-7219HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticatGo · github.com/hashicorp/consul · fixed in 1.6.3
- CVE-2020-7218HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticateGo · github.com/hashicorp/nomad · fixed in 0.10.3
- CVE-2020-7955HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential uGo · github.com/hashicorp/consul · fixed in 1.6.3
- CVE-2020-5233Open Redirect in OAuth2 ProxyGo · github.com/oauth2-proxy/oauth2-proxy · fixed in 5.0.0
- CVE-2020-7220HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespacGo · github.com/hashicorp/vault · fixed in 1.3.2
- CVE-2020-0601A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacGo · stdlib · fixed in 1.12.16, 1.13.7
- CVE-2018-1002104Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.Go · k8s.io/ingress-nginx · fixed in 1.5
- CVE-2019-19724Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could Go · github.com/sylabs/singularity · fixed in 3.5.2
- CVE-2019-19794The miekg Go DNS package before 1.1.25, as used in CoreDNS before 1.6.6 and other products, improperly generates random numbers because mathGo · github.com/miekg/dns · fixed in 1.1.25-0.20191211073109-8ebf2e419df7, 1.1.25
- CVE-2019-19619domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content.Go · github.com/documize/community · fixed in 3.5.1, 1.76.3-0.20191119114751-a4384210d4d0
- CVE-2019-11255Kubernetes CSI volume snapshot, cloning and resizing features can result in unauthorized volume data access or mutationGo · github.com/kubernetes-csi/external-provisioner, github.com/kubernetes-csi/external-resizer +1 · fixed in 0.4.3, 1.0.2, 1.2.2 and more
- CVE-2019-19316When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapGo · github.com/hashicorp/terraform · fixed in 0.12.17
- CVE-2014-9356Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection meGo · github.com/docker/docker · fixed in 1.3.3
- CVE-2019-10214The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenGo · github.com/containers/image · fixed in 3.0.0, 2.0.2-0.20190802080134-634605d06e73+incompatible
- CVE-2019-11289A forged route service request using an invalid nonce can cause the gorouter to panic and crashGo · code.cloudfoundry.org/gorouter, github.com/cloudfoundry/gorouter · fixed in 0.0.0-20191101214924-b1b5c44e050f
- CVE-2019-18817Istio 1.3.x before 1.3.5 allows Denial of Service because continue_on_listener_filters_timeout is set to True, a related issue to CVE-2019-1Go · istio.io/istio · fixed in 1.3.5
- CVE-2019-18658In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciouGo · helm.sh/helm · fixed in 2.15.2, 2.15.2+incompatible
- CVE-2019-10223A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1.Go · k8s.io/kube-state-metrics · fixed in 1.7.2
- CVE-2019-0210In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid inpGo · github.com/apache/thrift · fixed in 0.13.0
- CVE-2019-10743All versions of archiver allow attacker to perform a Zip Slip attack via the "unarchive" functions.Go · github.com/mholt/archiver · fixed in 3.3.2