Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-1905The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resourcGo · github.com/kubernetes/kubernetes · fixed in 1.2.0-alpha.6
- CVE-2016-1906Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that Go · github.com/openshift/origin · fixed in 1.1.1
- CVE-2015-8618The Int.Exp Montgomery code in the math/big library in Go 1.5.x before 1.5.3 mishandles carry propagation and produces incorrect output, whiGo · stdlib · fixed in 1.5.3
- CVE-2015-5305Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files vGo · github.com/kubernetes/kubernetes, k8s.io/kubernetes · fixed in 1.1.1
- CVE-2015-5250The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data.Go · github.com/openshift/origin · fixed in 1.0.6
- CVE-2015-3627Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allowsGo · github.com/docker/docker · fixed in 1.6.1
- CVE-2015-3629Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrGo · github.com/docker/docker · fixed in 1.6.1
- CVE-2015-3630Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, whiGo · github.com/docker/docker · fixed in 1.6.1
- CVE-2015-3631Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows vGo · github.com/docker/docker · fixed in 1.6.1
- CVE-2014-9357Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in Go · github.com/docker/docker · fixed in 1.3.3
- CVE-2014-9358Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositoGo · github.com/docker/docker · fixed in 1.3.2
- CVE-2014-6407Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attackGo · github.com/docker/docker · fixed in 1.3.2
- CVE-2014-6408Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container bGo · github.com/docker/docker · fixed in 1.3.2
- CVE-2014-8681SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1Go · github.com/gogits/gogs, gogs.io/gogs · fixed in 0.5.8
- CVE-2014-8682Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to eGo · gogs.io/gogs · fixed in 0.5.8
- CVE-2014-8683Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote atGo · gogs.io/gogs · fixed in 0.5.8
- CVE-2014-5277Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-miGo · github.com/docker/docker · fixed in 1.3.1
- CVE-2014-7189crpyto/tls in Go 1.1 before 1.3.2, when SessionTicketsDisabled is enabled, allows man-in-the-middle attackers to spoof clients via unspecifiGo · stdlib · fixed in 1.3.2
- CVE-2014-3499Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unGo · github.com/docker/docker · fixed in 1.0.1
- CVE-2014-0177The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporGo · github.com/github/hub · fixed in 1.12.1