testkube-tw-toolkit-2.14.1_linux_amd64

digest	sha256:afaf071f728ad4b09560dadf6c23c360471d239fd6119140adddc9addca91387
vulnerabilities
platform	linux/amd64
size	56 MB
packages	213

google.golang.org/grpc 1.84.0 (golang) pkg:golang/google.golang.org/grpc@1.84.0 # tw-toolkit.Dockerfile (35:35) RUN adduser --disabled-password --home / --no-create-home --uid 1001 default Affected range >=1.84.0-dev <1.85.0-dev.0.20260825072537-93e31b48545e Fixed version 1.85.0-dev.0.20260825072537-93e31b48545e EPSS Score 0.641% EPSS Percentile 49th percentile Description In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, causing an unhandled panic and terminating the server.

github.com/docker/cli 29.7.2+incompatible (golang) pkg:golang/github.com/docker/cli@29.7.2%2Bincompatible # tw-toolkit.Dockerfile (35:35) RUN adduser --disabled-password --home / --no-create-home --uid 1001 default Affected range >=19.03.0+incompatible Fixed version Not Fixed EPSS Score 0.490% EPSS Percentile 40th percentile Description Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

golang.org/x/crypto 0.57.0 (golang) pkg:golang/golang.org/x/crypto@0.57.0 # tw-toolkit.Dockerfile (35:35) RUN adduser --disabled-password --home / --no-create-home --uid 1001 default Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

github.com/chrismellard/docker-credential-acr-env 0.0.0-20230304212654-82a0ddb27589 (golang) pkg:golang/github.com/chrismellard/docker-credential-acr-env@0.0.0-20230304212654-82a0ddb27589 # tw-toolkit.Dockerfile (35:35) RUN adduser --disabled-password --home / --no-create-home --uid 1001 default Affected range >=0 Fixed version Not Fixed Description In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.