testkube-migration-2.12.2_linux_arm64

digest	sha256:4b1eb5438da1146e9e953b9a195769e5a0968831118cee5dd53cf3e5f3de95f0
vulnerabilities
platform	linux/arm64
size	50 MB
packages	277

github.com/docker/cli 29.6.2+incompatible (golang) pkg:golang/github.com/docker/cli@29.6.2%2Bincompatible Affected range >=19.03.0+incompatible Fixed version Not Fixed EPSS Score 0.472% EPSS Percentile 39th percentile Description Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

golang.org/x/crypto 0.55.0 (golang) pkg:golang/golang.org/x/crypto@0.55.0 Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

github.com/gofiber/fiber/v3 3.3.0 (golang) pkg:golang/github.com/gofiber/fiber/v3@3.3.0 Affected range <3.4.0 Fixed version 3.4.0 EPSS Score 0.178% EPSS Percentile 8th percentile Description GoFiber never set HSTS header in helmet middleware due to incorrect protocol check in github.com/gofiber/fiber

github.com/chrismellard/docker-credential-acr-env 0.0.0-20230304212654-82a0ddb27589 (golang) pkg:golang/github.com/chrismellard/docker-credential-acr-env@0.0.0-20230304212654-82a0ddb27589 Affected range >=0 Fixed version Not Fixed Description In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.