testkube-tw-toolkit-2.1.150_linux_arm64

digest	sha256:02a4d1202694fb7f0f18170306cafe9d50b8a5af92c0a2dc37c57f8d433f90cb
vulnerabilities
platform	linux/arm64
size	45 MB
packages	173

libexpat 2.6.4-r0 (apk) pkg:apk/alpine/libexpat@2.6.4-r0?arch=aarch64&distro=alpine-3.20.3&upstream=expat # tw-toolkit.Dockerfile (25:25) RUN apk --no-cache add ca-certificates libssl3 git openssh-client Affected range <2.7.0-r0 Fixed version 2.7.0-r0 EPSS Score 0.358% EPSS Percentile 57th percentile Description

golang.org/x/oauth2 0.26.0 (golang) pkg:golang/golang.org/x/oauth2@0.26.0 # tw-toolkit.Dockerfile (28:28) COPY --from=build /app/testworkflow-init /init Affected range <0.27.0 Fixed version 0.27.0 EPSS Score 0.056% EPSS Percentile 18th percentile Description An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

musl 1.2.5-r0 (apk) pkg:apk/alpine/musl@1.2.5-r0?arch=aarch64&distro=alpine-3.20.3 # tw-toolkit.Dockerfile (24:24) FROM ${ALPINE_IMAGE} Affected range <1.2.5-r1 Fixed version 1.2.5-r1 EPSS Score 0.010% EPSS Percentile 1st percentile Description

libssl3 3.3.2-r0 (apk) pkg:apk/alpine/libssl3@3.3.2-r0?arch=aarch64&distro=alpine-3.20.3&upstream=openssl # tw-toolkit.Dockerfile (24:24) FROM ${ALPINE_IMAGE} Affected range <3.3.3-r0 Fixed version 3.3.3-r0 EPSS Score 0.130% EPSS Percentile 34th percentile Description Affected range <3.3.2-r1 Fixed version 3.3.2-r1 EPSS Score 0.372% EPSS Percentile 58th percentile Description Affected range <3.3.2-r2 Fixed version 3.3.2-r2 EPSS Score 0.033% EPSS Percentile 8th percentile Description

golang.org/x/net 0.34.0 (golang) pkg:golang/golang.org/x/net@0.34.0 # tw-toolkit.Dockerfile (28:28) COPY --from=build /app/testworkflow-init /init Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Affected range <0.38.0 Fixed version 0.38.0 CVSS Score 5.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N EPSS Score 0.016% EPSS Percentile 2nd percentile Description The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. $,,\; etc\; contexts).$ Misinterpretation of Input Affected range <0.36.0 Fixed version 0.36.0 CVSS Score 4.4 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L EPSS Score 0.008% EPSS Percentile 0th percentile Description Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.