testkube-tw-init-2.15.2_linux_amd64

digest	sha256:bad2feba12b2b81b7917a401d1e913daad9b52e118177ca45bb233ecf325c56b
vulnerabilities
platform	linux/amd64
size	19 MB
packages	175

github.com/docker/cli 29.7.2+incompatible (golang) pkg:golang/github.com/docker/cli@29.7.2%2Bincompatible # tw-init.Dockerfile (22:22) COPY --from=build /app/testworkflow-init /init Affected range >=19.03.0+incompatible Fixed version Not Fixed EPSS Score 0.549% EPSS Percentile 46th percentile Description Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

stdlib 1.27.3 (golang) pkg:golang/stdlib@1.27.3 # tw-init.Dockerfile (22:22) COPY --from=build /app/testworkflow-init /init Affected range >=1.27.0-0 <1.27.4 Fixed version 1.27.4 EPSS Score 0.171% EPSS Percentile 7th percentile Description For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. As a result, an HTTP/1 server that utilizes MaxBytesReader or MaxBytesHandler can crash due to runtime panic if its handler reads the request body concurrently with writing the response header.

golang.org/x/crypto 0.58.0 (golang) pkg:golang/golang.org/x/crypto@0.58.0 # tw-init.Dockerfile (22:22) COPY --from=build /app/testworkflow-init /init Affected range <0.58.1-0.20261009181718-2f1f834330b2 Fixed version 0.58.1-0.20261009181718-2f1f834330b2 Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

github.com/chrismellard/docker-credential-acr-env 0.0.0-20230304212654-82a0ddb27589 (golang) pkg:golang/github.com/chrismellard/docker-credential-acr-env@0.0.0-20230304212654-82a0ddb27589 # tw-init.Dockerfile (22:22) COPY --from=build /app/testworkflow-init /init Affected range >=0 Fixed version Not Fixed Description In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.