testkube-tw-toolkit-2.1.143_linux_amd64

digest	sha256:49d5e459ae2f34c45fff3d954a1f7c44a437c2454afb11b6742592b5b7e3bd9e
vulnerabilities
platform	linux/amd64
size	48 MB
packages	173

musl 1.2.5-r0 (apk) pkg:apk/alpine/musl@1.2.5-r0?arch=x86_64&distro=alpine-3.20.3 # tw-toolkit.Dockerfile (24:24) FROM ${ALPINE_IMAGE} Affected range <1.2.5-r1 Fixed version 1.2.5-r1 EPSS Score 0.010% EPSS Percentile 1st percentile Description

libexpat 2.6.4-r0 (apk) pkg:apk/alpine/libexpat@2.6.4-r0?arch=x86_64&distro=alpine-3.20.3&upstream=expat # tw-toolkit.Dockerfile (25:25) RUN apk --no-cache add ca-certificates libssl3 git openssh-client Affected range <2.7.0-r0 Fixed version 2.7.0-r0 EPSS Score 0.346% EPSS Percentile 56th percentile Description

golang.org/x/crypto 0.32.0 (golang) pkg:golang/golang.org/x/crypto@0.32.0 # tw-toolkit.Dockerfile (28:28) COPY --from=build /app/testworkflow-init /init Affected range <0.35.0 Fixed version 0.35.0 EPSS Score 0.042% EPSS Percentile 12th percentile Description SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

golang.org/x/oauth2 0.26.0 (golang) pkg:golang/golang.org/x/oauth2@0.26.0 # tw-toolkit.Dockerfile (28:28) COPY --from=build /app/testworkflow-init /init Affected range <0.27.0 Fixed version 0.27.0 EPSS Score 0.051% EPSS Percentile 16th percentile Description An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

libssl3 3.3.2-r0 (apk) pkg:apk/alpine/libssl3@3.3.2-r0?arch=x86_64&distro=alpine-3.20.3&upstream=openssl # tw-toolkit.Dockerfile (24:24) FROM ${ALPINE_IMAGE} Affected range <3.3.3-r0 Fixed version 3.3.3-r0 EPSS Score 0.183% EPSS Percentile 41st percentile Description Affected range <3.3.2-r1 Fixed version 3.3.2-r1 EPSS Score 0.372% EPSS Percentile 58th percentile Description Affected range <3.3.2-r2 Fixed version 3.3.2-r2 EPSS Score 0.033% EPSS Percentile 8th percentile Description

golang.org/x/net 0.34.0 (golang) pkg:golang/golang.org/x/net@0.34.0 # tw-toolkit.Dockerfile (28:28) COPY --from=build /app/testworkflow-init /init Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <0.38.0 Fixed version 0.38.0 CVSS Score 5.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N EPSS Score 0.012% EPSS Percentile 1st percentile Description The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. $,,\; etc\; contexts).$ Misinterpretation of Input Affected range <0.36.0 Fixed version 0.36.0 CVSS Score 4.4 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L EPSS Score 0.009% EPSS Percentile 1st percentile Description Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.