Skip to main content
New to Testkube? Unleash the power of cloud native testing in Kubernetes with Testkube. Get Started >

testkube-api-server-2.1.44_linux_amd64

digestsha256:6f99ff5f8a3fc6f4cb5cd893fb1834926ffe5dfc7fd13df2ebd0ea5004582876
vulnerabilitiescritical: 1 high: 1 medium: 4 low: 0 unspecified: 2
size58 MB
packages205
critical: 1 high: 1 medium: 0 low: 0 unspecified: 2openssl 3.3.0-r2 (apk)

pkg:apk/alpine/openssl@3.3.0-r2?os_name=alpine&os_version=3.20
critical : CVE--2024--5535

Affected range<3.3.1-r1
Fixed version3.3.1-r1
EPSS Score0.04%
EPSS Percentile14th percentile
Description

high : CVE--2024--6119

Affected range<3.3.2-r0
Fixed version3.3.2-r0
EPSS Score0.04%
EPSS Percentile16th percentile
Description

unspecified : CVE--2024--9143

Affected range<3.3.2-r1
Fixed version3.3.2-r1
EPSS Score0.04%
EPSS Percentile11th percentile
Description

unspecified : CVE--2024--4741

Affected range<3.3.0-r3
Fixed version3.3.0-r3
Description
critical: 0 high: 0 medium: 2 low: 0 busybox 1.36.1-r28 (apk)

pkg:apk/alpine/busybox@1.36.1-r28?os_name=alpine&os_version=3.20
medium : CVE--2023--42365

Affected range<1.36.1-r29
Fixed version1.36.1-r30
EPSS Score0.04%
EPSS Percentile14th percentile
Description

medium : CVE--2023--42364

Affected range<1.36.1-r29
Fixed version1.36.1-r30
EPSS Score0.04%
EPSS Percentile14th percentile
Description
critical: 0 high: 0 medium: 1 low: 0 github.com/vektah/gqlparser/v2 2.5.2-0.20230422221642-25e09f9d292d (golang)

pkg:golang/github.com/vektah/gqlparser@2.5.2-0.20230422221642-25e09f9d292d#v2
medium 5.3: CVE--2023--49559 Uncontrolled Resource Consumption

Affected range<2.5.14
Fixed version2.5.14
CVSS Score5.3
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score0.04%
EPSS Percentile10th percentile
Description

An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.

critical: 0 high: 0 medium: 1 low: 0 gopkg.in/square/go-jose.v2 2.6.0 (golang)

pkg:golang/gopkg.in/square/go-jose.v2@2.6.0
medium 4.3: CVE--2024--28180 Improper Handling of Highly Compressed Data (Data Amplification)

Affected range<=2.6.0
Fixed versionNot Fixed
CVSS Score4.3
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS Score0.05%
EPSS Percentile18th percentile
Description

Impact​

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.

Patches​

The problem is fixed in the following packages and versions:

  • github.com/go-jose/go-jose/v4 version 4.0.1
  • github.com/go-jose/go-jose/v3 version 3.0.3
  • gopkg.in/go-jose/go-jose.v2 version 2.6.3

The problem will not be fixed in the following package because the package is archived:

  • gopkg.in/square/go-jose.v2