testkube-kubectl-1.36.2_linux_arm64

digest	sha256:82452e1f159fb1a2d9b4a4ed647fb532f2e7550b572fe383f7094d06f8303924
vulnerabilities
platform	linux/arm64
size	24 MB
packages	119

curl 8.20.0-r1 (apk) pkg:apk/alpine/curl@8.20.0-r1?os_name=alpine&os_version=3.24 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.2 Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.604% EPSS Percentile 46th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.507% EPSS Percentile 41st percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.363% EPSS Percentile 30th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.339% EPSS Percentile 27th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.491% EPSS Percentile 40th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.577% EPSS Percentile 45th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.325% EPSS Percentile 25th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.399% EPSS Percentile 33rd percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.268% EPSS Percentile 19th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.295% EPSS Percentile 22nd percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.584% EPSS Percentile 45th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.396% EPSS Percentile 33rd percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.440% EPSS Percentile 37th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.376% EPSS Percentile 31st percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.592% EPSS Percentile 46th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.560% EPSS Percentile 44th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.315% EPSS Percentile 24th percentile Description Affected range <8.21.0-r0 Fixed version 8.21.0-r0 EPSS Score 0.309% EPSS Percentile 24th percentile Description

stdlib 1.26.4 (golang) pkg:golang/stdlib@1.26.4 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.2 Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.655% EPSS Percentile 49th percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.483% EPSS Percentile 40th percentile Description Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.483% EPSS Percentile 40th percentile Description Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.590% EPSS Percentile 46th percentile Description When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.350% EPSS Percentile 28th percentile Description Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.465% EPSS Percentile 39th percentile Description Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.263% EPSS Percentile 18th percentile Description Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.441% EPSS Percentile 37th percentile Description Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations. Affected range >=1.26.0-0 <1.26.5 Fixed version 1.26.5 EPSS Score 0.382% EPSS Percentile 32nd percentile Description Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. Affected range >=1.26.0-0 <1.26.5 Fixed version 1.26.5 EPSS Score 0.232% EPSS Percentile 14th percentile Description On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

golang.org/x/net 0.49.0 (golang) pkg:golang/golang.org/x/net@0.49.0 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.2 Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.655% EPSS Percentile 49th percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.350% EPSS Percentile 28th percentile Description Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Affected range <0.53.0 Fixed version 0.53.0 EPSS Score 0.781% EPSS Percentile 53rd percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Uncontrolled Resource Consumption Affected range <0.55.0 Fixed version 0.55.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.326% EPSS Percentile 26th percentile Description In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.235% EPSS Percentile 15th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 13th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 13th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 13th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

k8s.io/kubernetes 1.36.2 (golang) pkg:golang/k8s.io/kubernetes@1.36.2 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.2 Affected range >=0 Fixed version Not Fixed EPSS Score 0.539% EPSS Percentile 43rd percentile Description Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes Affected range >=1.3.0 Fixed version Not Fixed EPSS Score 0.314% EPSS Percentile 24th percentile Description Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes

go.opentelemetry.io/otel 1.41.0 (golang) pkg:golang/go.opentelemetry.io/otel@1.41.0 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.2 Affected range >=1.41.0 <1.42.0 Fixed version 1.42.0 EPSS Score 0.237% EPSS Percentile 15th percentile Description Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

golang.org/x/sys 0.40.0 (golang) pkg:golang/golang.org/x/sys@0.40.0 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.2 Affected range <0.44.0 Fixed version 0.44.0 EPSS Score 0.114% EPSS Percentile 2nd percentile Description NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

nghttp2 1.69.0-r0 (apk) pkg:apk/alpine/nghttp2@1.69.0-r0?os_name=alpine&os_version=3.24 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.2 Affected range <1.70.0-r0 Fixed version 1.70.0-r0 EPSS Score 0.263% EPSS Percentile 18th percentile Description

golang.org/x/text 0.33.0 (golang) pkg:golang/golang.org/x/text@0.33.0 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.2 Affected range <0.39.0 Fixed version 0.39.0 EPSS Score 0.446% EPSS Percentile 37th percentile Description A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

c-ares 1.34.6-r0 (apk) pkg:apk/alpine/c-ares@1.34.6-r0?os_name=alpine&os_version=3.24 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.2 Affected range <1.34.8-r0 Fixed version 1.34.8-r0 Description