testkube-api-server-2.1.150_linux_amd64

digest	sha256:0bc7713bd3b5e4cf747febad5a6b819d21e972238c0b84de305fefa4a1317050
vulnerabilities
platform	linux/amd64
size	66 MB
packages	209

libexpat 2.6.4-r0 (apk) pkg:apk/alpine/libexpat@2.6.4-r0?arch=x86_64&distro=alpine-3.20.3&upstream=expat # api-server.Dockerfile (34:34) RUN apk --no-cache add ca-certificates libssl3 git Affected range <2.7.0-r0 Fixed version 2.7.0-r0 EPSS Score 0.358% EPSS Percentile 57th percentile Description

golang.org/x/oauth2 0.26.0 (golang) pkg:golang/golang.org/x/oauth2@0.26.0 # api-server.Dockerfile (36:36) COPY --from=build /app /bin/app Affected range <0.27.0 Fixed version 0.27.0 EPSS Score 0.056% EPSS Percentile 18th percentile Description An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

musl 1.2.5-r0 (apk) pkg:apk/alpine/musl@1.2.5-r0?arch=x86_64&distro=alpine-3.20.3 # api-server.Dockerfile (33:33) FROM ${ALPINE_IMAGE} Affected range <1.2.5-r1 Fixed version 1.2.5-r1 EPSS Score 0.010% EPSS Percentile 1st percentile Description

libssl3 3.3.2-r0 (apk) pkg:apk/alpine/libssl3@3.3.2-r0?arch=x86_64&distro=alpine-3.20.3&upstream=openssl # api-server.Dockerfile (33:33) FROM ${ALPINE_IMAGE} Affected range <3.3.3-r0 Fixed version 3.3.3-r0 EPSS Score 0.130% EPSS Percentile 34th percentile Description Affected range <3.3.2-r1 Fixed version 3.3.2-r1 EPSS Score 0.372% EPSS Percentile 58th percentile Description Affected range <3.3.2-r2 Fixed version 3.3.2-r2 EPSS Score 0.033% EPSS Percentile 8th percentile Description

golang.org/x/net 0.34.0 (golang) pkg:golang/golang.org/x/net@0.34.0 # api-server.Dockerfile (36:36) COPY --from=build /app /bin/app Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <0.38.0 Fixed version 0.38.0 CVSS Score 5.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N EPSS Score 0.016% EPSS Percentile 2nd percentile Description The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. $,,\; etc\; contexts).$ Misinterpretation of Input Affected range <0.36.0 Fixed version 0.36.0 CVSS Score 4.4 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L EPSS Score 0.008% EPSS Percentile 0th percentile Description Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.

gopkg.in/square/go-jose.v2 2.6.0 (golang) pkg:golang/gopkg.in/square/go-jose.v2@2.6.0 # api-server.Dockerfile (36:36) COPY --from=build /app /bin/app Improper Handling of Highly Compressed Data (Data Amplification) Affected range <=2.6.0 Fixed version Not Fixed CVSS Score 4.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.247% EPSS Percentile 48th percentile Description Impact An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting. Patches The problem is fixed in the following packages and versions: github.com/go-jose/go-jose/v4 version 4.0.1 github.com/go-jose/go-jose/v3 version 3.0.3 gopkg.in/go-jose/go-jose.v2 version 2.6.3 The problem will not be fixed in the following package because the package is archived: gopkg.in/square/go-jose.v2

github.com/vektah/gqlparser/v2 2.5.2-0.20230422221642-25e09f9d292d (golang) pkg:golang/github.com/vektah/gqlparser@2.5.2-0.20230422221642-25e09f9d292d#v2 # api-server.Dockerfile (36:36) COPY --from=build /app /bin/app Uncontrolled Resource Consumption Affected range <2.5.14 Fixed version 2.5.14 CVSS Score 5.3 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L EPSS Score 0.061% EPSS Percentile 20th percentile Description An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.