testkube-kubectl-1.36.3_linux_arm64

digest	sha256:d55712bd9aa80ca417a9df125d702e9965eaa5537eca07e71d0bd084cf0d3283
vulnerabilities
platform	linux/arm64
size	24 MB
packages	119

openssl 3.5.7-r0 (apk) pkg:apk/alpine/openssl@3.5.7-r0?os_name=alpine&os_version=3.24 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.3 Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 1.159% EPSS Percentile 66th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.221% EPSS Percentile 11th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 1.823% EPSS Percentile 78th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.778% EPSS Percentile 54th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 1.009% EPSS Percentile 62nd percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 1.311% EPSS Percentile 70th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 1.537% EPSS Percentile 74th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 1.021% EPSS Percentile 62nd percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.729% EPSS Percentile 52nd percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.560% EPSS Percentile 45th percentile Description

curl 8.21.0-r0 (apk) pkg:apk/alpine/curl@8.21.0-r0?os_name=alpine&os_version=3.24 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.3 Affected range <8.22.0-r0 Fixed version 8.22.0-r0 EPSS Score 0.747% EPSS Percentile 53rd percentile Description Affected range <8.22.0-r0 Fixed version 8.22.0-r0 EPSS Score 0.584% EPSS Percentile 46th percentile Description Affected range <8.22.0-r0 Fixed version 8.22.0-r0 EPSS Score 0.373% EPSS Percentile 29th percentile Description Affected range <8.22.0-r0 Fixed version 8.22.0-r0 EPSS Score 0.407% EPSS Percentile 33rd percentile Description Affected range <8.22.0-r0 Fixed version 8.22.0-r0 EPSS Score 0.478% EPSS Percentile 39th percentile Description Affected range <8.22.0-r0 Fixed version 8.22.0-r0 EPSS Score 0.898% EPSS Percentile 58th percentile Description Affected range <8.22.0-r0 Fixed version 8.22.0-r0 EPSS Score 0.371% EPSS Percentile 29th percentile Description Affected range <8.22.0-r0 Fixed version 8.22.0-r0 EPSS Score 0.563% EPSS Percentile 45th percentile Description Affected range <8.22.0-r0 Fixed version 8.22.0-r0 EPSS Score 0.479% EPSS Percentile 39th percentile Description Affected range <8.22.0-r0 Fixed version 8.22.0-r0 Description

stdlib 1.26.5 (golang) pkg:golang/stdlib@1.26.5 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.3 Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.692% EPSS Percentile 51st percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.568% EPSS Percentile 45th percentile Description Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.568% EPSS Percentile 45th percentile Description Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.568% EPSS Percentile 45th percentile Description When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.630% EPSS Percentile 48th percentile Description Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.568% EPSS Percentile 45th percentile Description Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.310% EPSS Percentile 21st percentile Description Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS. Affected range >=1.26.0-0 <1.26.6 Fixed version 1.26.6 EPSS Score 0.550% EPSS Percentile 44th percentile Description Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

golang.org/x/net 0.49.0 (golang) pkg:golang/golang.org/x/net@0.49.0 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.3 Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.692% EPSS Percentile 51st percentile Description The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com". Affected range <0.56.0 Fixed version 0.56.0 EPSS Score 0.630% EPSS Percentile 48th percentile Description Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. Affected range <0.53.0 Fixed version 0.53.0 EPSS Score 0.781% EPSS Percentile 54th percentile Description When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0. Uncontrolled Resource Consumption Affected range <0.55.0 Fixed version 0.55.0 CVSS Score 6.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H EPSS Score 0.460% EPSS Percentile 37th percentile Description In Go Net (golang.org/x/net) before verion 0.55.0, parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.333% EPSS Percentile 24th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 12th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 12th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering. Affected range <0.55.0 Fixed version 0.55.0 EPSS Score 0.223% EPSS Percentile 12th percentile Description Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

k8s.io/kubernetes 1.36.3 (golang) pkg:golang/k8s.io/kubernetes@1.36.3 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.3 Affected range >=0 Fixed version Not Fixed EPSS Score 0.689% EPSS Percentile 51st percentile Description Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes Affected range >=1.3.0 Fixed version Not Fixed EPSS Score 0.314% EPSS Percentile 22nd percentile Description Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes

go.opentelemetry.io/otel 1.41.0 (golang) pkg:golang/go.opentelemetry.io/otel@1.41.0 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.3 Affected range >=1.41.0 <1.42.0 Fixed version 1.42.0 EPSS Score 0.336% EPSS Percentile 25th percentile Description Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

golang.org/x/sys 0.40.0 (golang) pkg:golang/golang.org/x/sys@0.40.0 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.3 Affected range <0.44.0 Fixed version 0.44.0 EPSS Score 0.158% EPSS Percentile 4th percentile Description NewNTUnicodeString does not check for string length overflow. When provided with a string that overflows the maximum size of a NTUnicodeString (a 16-bit number of bytes), it returns a truncated string rather than an error.

golang.org/x/text 0.33.0 (golang) pkg:golang/golang.org/x/text@0.33.0 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.3 Affected range <0.39.0 Fixed version 0.39.0 EPSS Score 0.475% EPSS Percentile 39th percentile Description A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

nghttp2 1.69.0-r0 (apk) pkg:apk/alpine/nghttp2@1.69.0-r0?os_name=alpine&os_version=3.24 # kubectl-release.dockerfile (5:5) FROM alpine/kubectl:1.36.3 Affected range <1.70.0-r0 Fixed version 1.70.0-r0 EPSS Score 0.319% EPSS Percentile 22nd percentile Description