Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2018-17031In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet ExplGo · gogs.io/gogs · fixed in 0.12.0
- CVE-2018-12608An issue was discovered in Docker Moby before 17.06.0.Go · github.com/docker/docker · fixed in 17.06.0-ce
- CVE-2018-16733In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block.Go · github.com/ethereum/go-ethereum · fixed in 1.8.14
- CVE-2018-14632An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before Go · github.com/evanphx/json-patch · fixed in 0.5.2, 3.0.1-0.20180525145409-4c9aadca8f89+incompatible, 3.0.1-0.20180525145409-4c9aadca8f89
- CVE-2018-15727Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember Go · github.com/grafana/grafana · fixed in 4.6.4+incompatible, 5.2.3+incompatible, 4.6.4 and more
- CVE-2018-6558The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with theGo · github.com/google/fscrypt · fixed in 0.2.4
- CVE-2018-15598Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's pGo · github.com/traefik/traefik · fixed in 1.6.6
- CVE-2018-15192An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.Go · code.gitea.io/gitea, gogs.io/gogs · fixed in 1.16.0-rc1, 0.12.0
- CVE-2018-15178Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacksGo · gogs.io/gogs · fixed in 0.12.0
- CVE-2018-1002207mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3 is vulnerable to directory traversal, allowing attackers to wrGo · github.com/mholt/archiver · fixed in 2.1.0+incompatible, 2.1.0
- CVE-2018-12021Singularity 2.3.0 through 2.5.1 is affected by an incorrect access control on systems supporting overlay file system.Go · github.com/hpcng/singularity · fixed in 2.5.2
- CVE-2018-12018The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation beGo · github.com/ethereum/go-ethereum · fixed in 1.8.11
- CVE-2018-10856It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user.Go · github.com/containers/podman, github.com/containers/podman/v2 +2 · fixed in 0.6.1
- CVE-2018-1103Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input.Go · github.com/openshift/source-to-image · fixed in 1.1.10-0.20180427153919-f5cbcbc5cc6f
- CVE-2018-12099Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.Go · github.com/grafana/grafana · fixed in 5.2.0-beta1+incompatible, 5.2.0-beta1
- CVE-2018-1002100In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned fGo · k8s.io/kubernetes · fixed in 1.9.6
- CVE-2018-1098A cross-site request forgery flaw was found in etcd 3.3.1 and earlier.Go · go.etcd.io/etcd/v3 · fixed in 3.4.0
- CVE-2018-1099DNS rebinding vulnerability found in etcd 3.3.1 and earlier.Go · go.etcd.io/etcd · fixed in 3.4.0
- CVE-2015-9258In Docker Notary before 0.1, gotuf/signed/verify.go has a Signature Algorithm Not Matched to Key vulnerability.Go · github.com/docker/notary · fixed in 0.1.0
- CVE-2018-9057aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriatGo · github.com/hashicorp/terraform-provider-aws · fixed in 1.14.0
- CVE-2017-1002102In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projecGo · k8s.io/kubernetes · fixed in 1.7.14, 1.8.9, 1.9.4
- CVE-2018-7187The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only Go · toolchain · fixed in 1.9.5, 1.10.1
- CVE-2016-5397The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tGo · github.com/apache/thrift · fixed in 0.10.0
- CVE-2018-6574Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source codGo · toolchain · fixed in 1.8.7, 1.9.4
- CVE-2017-15133A denial of service flaw was found in miekg-dns before 1.0.4.Go · github.com/miekg/dns · fixed in 1.0.4-0.20180125103619-43913f2f4fbd, 1.0.4
- CVE-2017-1000420Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwriteGo · github.com/syncthing/syncthing
- CVE-2017-17831GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostnGo · github.com/git-lfs/git-lfs · fixed in 2.1.1-0.20170519163204-f913f5f9c7c6+incompatible, 2.1.1-0.20170519163204-f913f5f9c7c6
- CVE-2017-15103A security-check flaw was found in the way the Heketi 5 server API handled user requests.Go · github.com/heketi/heketi · fixed in 5.0.1+incompatible, 5.0.1
- CVE-2017-15104An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable.Go · github.com/heketi/heketi · fixed in 5.0.1, 5.0.1+incompatible
- CVE-2017-11480Packetbeat versions prior to 5.6.4 are affected by a denial of service flaw in the PostgreSQL protocol handler.Go · github.com/elastic/beats · fixed in 6.1.0+incompatible, 5.6.4, 6.0.0