testkube-tw-toolkit-2.15.0_linux_arm64

digest	sha256:4f76f776b0adb3075445f9e1fbf68d61d6b9fd1771c362c4b22297e095f7bc11
vulnerabilities
platform	linux/arm64
size	49 MB
packages	212

github.com/docker/cli 29.7.2+incompatible (golang) pkg:golang/github.com/docker/cli@29.7.2%2Bincompatible # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range >=19.03.0+incompatible Fixed version Not Fixed EPSS Score 0.501% EPSS Percentile 43rd percentile Description Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

golang.org/x/net 0.60.0 (golang) pkg:golang/golang.org/x/net@0.60.0 # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range <0.62.0 Fixed version 0.62.0 EPSS Score 0.202% EPSS Percentile 10th percentile Description In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text. Affected range <0.62.0 Fixed version 0.62.0 EPSS Score 0.185% EPSS Percentile 8th percentile Description When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse.

musl 1.2.6-r3 (apk) pkg:apk/alpine/musl@1.2.6-r3?arch=aarch64&distro=alpine-3.24.3 # tw-toolkit.Dockerfile (30:30) FROM ${ALPINE_IMAGE} Affected range <1.2.6-r6 Fixed version 1.2.6-r6 Description

musl-utils 1.2.6-r3 (apk) pkg:apk/alpine/musl-utils@1.2.6-r3?arch=aarch64&distro=alpine-3.24.3&upstream=musl # tw-toolkit.Dockerfile (30:30) FROM ${ALPINE_IMAGE} Affected range <1.2.6-r6 Fixed version 1.2.6-r6 Description

golang.org/x/crypto 0.57.0 (golang) pkg:golang/golang.org/x/crypto@0.57.0 # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range >=0 Fixed version Not Fixed Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

github.com/chrismellard/docker-credential-acr-env 0.0.0-20230304212654-82a0ddb27589 (golang) pkg:golang/github.com/chrismellard/docker-credential-acr-env@0.0.0-20230304212654-82a0ddb27589 # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range >=0 Fixed version Not Fixed Description In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.