testkube-nats-2.14.3_linux_amd64

digest	sha256:d88f532e9483e081d8e0e71c9baee90dd0a30babab2df5b0bf91bf018fb463c7
vulnerabilities
platform	linux/amd64
size	11 MB
packages	32

busybox 1.37.0-r20 (apk) pkg:apk/alpine/busybox@1.37.0-r20?os_name=alpine&os_version=3.22 # nats-release.dockerfile (8:8) FROM nats:2.14.3-alpine Affected range <=1.37.0-r20 Fixed version Not Fixed EPSS Score 0.285% EPSS Percentile 21st percentile Description

stdlib 1.26.4 (golang) pkg:golang/stdlib@1.26.4 # nats-release.dockerfile (8:8) FROM nats:2.14.3-alpine Affected range >=1.26.0-0 <1.26.5 Fixed version 1.26.5 EPSS Score 0.413% EPSS Percentile 34th percentile Description Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. Affected range >=1.26.0-0 <1.26.5 Fixed version 1.26.5 EPSS Score 0.183% EPSS Percentile 8th percentile Description On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.

golang.org/x/crypto 0.53.0 (golang) pkg:golang/golang.org/x/crypto@0.53.0 # nats-release.dockerfile (8:8) FROM nats:2.14.3-alpine Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.