Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-18466An issue was discovered in Podman in libpod before 1.6.0.Go · github.com/containers/libpod, github.com/containers/podman +3 · fixed in 1.6.0
- CVE-2019-17596Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key.Go · stdlib · fixed in 1.12.11, 1.13.2
- CVE-2019-11253Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attackGo · k8s.io/kubernetes · fixed in 1.13.12, 1.14.8, 1.15.5 and more
- CVE-2019-16276Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.Go · stdlib · fixed in 1.12.10, 1.13.1
- CVE-2019-16884runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rooGo · github.com/opencontainers/runc, github.com/opencontainers/selinux · fixed in 1.0.0-rc8.0.20190930145003-cad42f6e0932, 1.3.1-0.20190929122143-5215b1806f52
- CVE-2019-16355The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.Go · github.com/astaxie/beego, github.com/beego/beego · fixed in 1.12.2
- CVE-2019-16354The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation Go · github.com/astaxie/beego, github.com/beego/beego · fixed in 1.12.2
- CVE-2019-12405Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API cGo · github.com/apache/trafficcontrol · fixed in 3.0.2-RC1
- CVE-2019-16146Gophish through 0.8.0 allows XSS via a username.Go · github.com/gophish/gophish · fixed in 0.9.0
- CVE-2019-16097core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is sGo · github.com/goharbor/harbor · fixed in 1.9.0-rc1
- CVE-2019-13209Rancher 2 through 2.2.4 is vulnerable to a Cross-Site Websocket Hijacking attack that allows an exploiter to gain access to clusters managedGo · github.com/rancher/rancher · fixed in 2.2.5-rc6.0.20190621200032-0ddffe484adc+incompatible, 2.0.16, 2.1.11 and more
- CVE-2019-11250Kubernetes client-go logs authorization headers at debug verbosity levelsGo · k8s.io/client-go, k8s.io/kubernetes · fixed in 0.17.0, 1.16.0-beta.1
- CVE-2019-11247Kubernetes kube-apiserver allows access to custom resources via wrong scopeGo · k8s.io/apiextensions-apiserver · fixed in 0.13.9, 0.14.5, 0.15.2
- CVE-2019-11245kubelet-started container uid changes to root after first restart or if image is already pulled to the nodeGo · k8s.io/kubernetes, k8s.io/kubernetes/cmd/kubelet · fixed in 1.13.7, 1.14.3
- CVE-2019-15119lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrGo · ehang.io/nps, github.com/cnlh/nps · fixed in 0.23.2
- CVE-2019-14809net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applicaGo · stdlib · fixed in 1.11.13, 1.12.8
- CVE-2019-9512Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of serviceGo · golang.org/x/net, stdlib · fixed in 0.0.0-20190813141303-74dc4d7220e7, 1.11.13, 1.12.8
- CVE-2019-14993Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWGo · istio.io/istio · fixed in 1.1.13, 1.2.4
- CVE-2019-9514Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of serviceGo · golang.org/x/net, stdlib · fixed in 0.0.0-20190813141303-74dc4d7220e7, 1.11.13, 1.12.8
- CVE-2019-12618HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.Go · github.com/hashicorp/nomad · fixed in 0.9.2
- CVE-2019-14544routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.Go · gogs.io/gogs · fixed in 0.11.91
- CVE-2019-10152A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers.Go · github.com/containers/podman · fixed in 1.4.0
- CVE-2019-11202An issue was discovered that affects the following versions of Rancher: v2.0.0 through v2.0.13, v2.1.0 through v2.1.8, and v2.2.0 through 2.Go · github.com/rancher/rancher · fixed in 2.2.2+incompatible, 2.2.2
- CVE-2019-14271In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamicalGo · github.com/docker/docker, github.com/moby/moby · fixed in 19.03.1, 20.10.0-beta1+incompatible
- CVE-2019-13126An integer overflow in NATS Server before 2.0.2 allows a remote attacker to crash the server by sending a crafted request.Go · github.com/nats-io/nats-server, github.com/nats-io/nats-server/v2 · fixed in 2.2.0
- CVE-2019-14243headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, Go · github.com/mastercactapus/proxyprotocol · fixed in 0.0.2
- CVE-2019-1010261Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS).Go · code.gitea.io/gitea · fixed in 1.7.1
- CVE-2019-13509In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode maGo · github.com/docker/docker · fixed in 18.09.8
- CVE-2019-13915b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files.Go · github.com/b3log/wide · fixed in 1.6.0
- CVE-2019-1010275helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation.Go · helm.sh/helm · fixed in 2.7.2+incompatible, 2.7.2