Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2017-16539The DefaultLinuxSpec function in oci/defaults.go in Docker Moby through 17.03.2-ce does not block /proc/scsi pathnames, which allows attackeGo · github.com/moby/moby · fixed in 17.12.0-ce
- CVE-2017-14992Lack of content verification in Docker-CE (Also known as Moby) versions 1.12.6-0, 1.10.3, 17.03.0, 17.03.1, 17.03.2, 17.06.0, 17.06.1, 17.06Go · github.com/vbatts/tar-split · fixed in 0.10.2
- CVE-2015-5739The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers tGo · stdlib · fixed in 1.4.3
- CVE-2015-5740The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduGo · stdlib · fixed in 1.4.3
- CVE-2017-15041Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution.Go · toolchain · fixed in 1.8.4, 1.9.1
- CVE-2017-15042An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1.Go · stdlib · fixed in 1.8.4, 1.9.1
- CVE-2017-1000097On Darwin, user's trust preferences for root certificates were not honored.Go · stdlib · fixed in 1.6.4, 1.7.4
- CVE-2017-1000098The net/http package's Request.ParseMultipartForm method starts writing to temporary files once the request body size surpasses the given "mGo · stdlib · fixed in 1.6.4, 1.7.4
- CVE-2015-5237protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.Go · github.com/protocolbuffers/protobuf · fixed in 3.4.0
- CVE-2017-14623In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password.Go · github.com/go-ldap/ldap · fixed in 2.5.0+incompatible, 2.5.0
- CVE-2015-7561Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.Go · k8s.io/kubernetes · fixed in 1.2.0-alpha.6
- CVE-2017-11468Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remoGo · github.com/docker/distribution · fixed in 2.7.0-rc.0+incompatible, 2.7.0-rc.0
- CVE-2017-1000056Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability toGo · k8s.io/kubernetes · fixed in 1.5.5
- CVE-2017-1000069CSRF in Bitly oauth2_proxy 2.1 during authentication flowGo · github.com/bitly/oauth2_proxy · fixed in 2.2.0
- CVE-2017-1000070The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-lGo · github.com/bitly/oauth2_proxy · fixed in 2.2.0
- CVE-2017-7670The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack.Go · github.com/apache/trafficcontrol · fixed in 1.8.1, 2.0.0, 2.1.0-RC1 and more
- CVE-2017-8932A bug in the standard library ScalarMult implementation of curve P-256 for amd64 architectures in Go before 1.7.6 and 1.8.x before 1.8.2 cauGo · stdlib · fixed in 1.7.6, 1.8.2
- CVE-2017-9232Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing Go · github.com/juju/juju · fixed in 0.0.0-20170524231039-0417178a3c28
- CVE-2017-3204The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks.Go · golang.org/x/crypto · fixed in 0.0.0-20170330155735-e4e2799dd7aa
- CVE-2017-7297Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call.Go · github.com/rancher/rancher · fixed in 1.5.3, 1.4.3, 1.3.5 and more
- CVE-2016-9121go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm.Go · github.com/square/go-jose, gopkg.in/square/go-jose.v1 · fixed in 1.0.4
- CVE-2016-9122go-jose before 1.0.4 suffers from multiple signatures exploitation.Go · gopkg.in/square/go-jose.v1 · fixed in 1.1.0
- CVE-2016-9123go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures.Go · github.com/square/go-jose · fixed in 0.0.0-20160903044734-789a4c4bd4c1
- CVE-2016-9962RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container.Go · github.com/opencontainers/runc · fixed in 1.0.0-rc3
- CVE-2016-8579docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.Go · github.com/appc/docker2aci · fixed in 0.13.0
- CVE-2016-5386The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protecGo · stdlib · fixed in 1.6.3
- CVE-2016-3697libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, whGo · github.com/opencontainers/runc · fixed in 0.1.0
- CVE-2016-3958Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan Go · stdlib · fixed in 1.5.4, 1.6.1
- CVE-2016-3959The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big inteGo · stdlib · fixed in 1.5.4, 1.6.1
- CVE-2015-7528Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.Go · github.com/kubernetes/kubernetes · fixed in 1.2.0