testkube-tw-toolkit-2.13.1_linux_amd64

digest	sha256:c49f2a9dead3c2b38da82d0ee29829fb16986575c4288aedef83a8e216dc9b2c
vulnerabilities
platform	linux/amd64
size	53 MB
packages	213

libssl3 3.5.7-r0 (apk) pkg:apk/alpine/libssl3@3.5.7-r0?arch=x86_64&distro=alpine-3.24.1&upstream=openssl # tw-toolkit.Dockerfile (30:30) FROM ${ALPINE_IMAGE} Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 1.330% EPSS Percentile 69th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.480% EPSS Percentile 39th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.612% EPSS Percentile 47th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.516% EPSS Percentile 42nd percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 1.481% EPSS Percentile 72nd percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.984% EPSS Percentile 60th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.729% EPSS Percentile 52nd percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.488% EPSS Percentile 40th percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.116% EPSS Percentile 2nd percentile Description Affected range <3.5.8-r0 Fixed version 3.5.8-r0 EPSS Score 0.409% EPSS Percentile 34th percentile Description

github.com/docker/cli 29.6.2+incompatible (golang) pkg:golang/github.com/docker/cli@29.6.2%2Bincompatible # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range >=19.03.0+incompatible Fixed version Not Fixed EPSS Score 0.472% EPSS Percentile 39th percentile Description Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

nghttp2-libs 1.69.0-r0 (apk) pkg:apk/alpine/nghttp2-libs@1.69.0-r0?arch=x86_64&distro=alpine-3.24.1&upstream=nghttp2 # tw-toolkit.Dockerfile (31:31) RUN apk --no-cache upgrade && apk --no-cache add ca-certificates libssl3 git openssh-client Affected range <1.70.0-r0 Fixed version 1.70.0-r0 EPSS Score 0.253% EPSS Percentile 17th percentile Description

github.com/chrismellard/docker-credential-acr-env 0.0.0-20230304212654-82a0ddb27589 (golang) pkg:golang/github.com/chrismellard/docker-credential-acr-env@0.0.0-20230304212654-82a0ddb27589 # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range >=0 Fixed version Not Fixed Description In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.

golang.org/x/crypto 0.55.0 (golang) pkg:golang/golang.org/x/crypto@0.55.0 # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.