This repository has been archived by the owner on Apr 22, 2022. It is now read-only.
github.com/kubernetes-sigs/cluster-api-v0.3.2: 11 vulnerabilities (highest severity is: 9.1) #9
Labels
security vulnerability
Security vulnerability detected by WhiteSource
Comments
mend-for-github-com
bot
added
the
security vulnerability
mend-for-github-com
bot
changed the title
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Vulnerabilities
Details
Vulnerable Library - github.com/docker/distribution-v2.7.1
The toolkit to pack, ship, store, and deliver container content
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
go-jose before 1.0.4 suffers from an invalid curve attack for the ECDH-ES algorithm. When deriving a shared key using ECDH-ES for an encrypted message, go-jose neglected to check that the received public key on a message is on the same curve as the static private key of the receiver, thus making it vulnerable to an invalid curve attack.
Publish Date: 2017-03-28
URL: CVE-2016-9121
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-9121
Release Date: 2017-03-28
Fix Resolution: 1.0.4
Vulnerable Library - github.com/docker/distribution-v2.7.1
The toolkit to pack, ship, store, and deliver container content
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
go-jose before 1.0.4 suffers from multiple signatures exploitation. The go-jose library supports messages with multiple signatures. However, when validating a signed message the API did not indicate which signature was valid, which could potentially lead to confusion. For example, users of the library might mistakenly read protected header values from an attached signature that was different from the one originally validated.
Publish Date: 2017-03-28
URL: CVE-2016-9122
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://osv.dev/vulnerability/GO-2020-0011
Release Date: 2017-03-28
Fix Resolution: v1.1.0
Vulnerable Library - github.com/kubernetes/apiserver-v0.17.2
Library for writing a Kubernetes-style API server.
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurred. This flaw allows an attacker with the ability to cause an API Server error to read the logs, and use the leaked OAuthToken to log into the API Server with the leaked token.
Publish Date: 2020-06-12
URL: CVE-2020-10752
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Vulnerable Library - github.com/docker/distribution-v2.7.1
The toolkit to pack, ship, store, and deliver container content
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of
promhttp.InstrumentHandler*middleware exceptRequestsInFlight; not filter any specific methods (e.g GET) before middleware; pass metric withmethodlabel name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknownmethod. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing themethodlabel name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.Publish Date: 2022-02-15
URL: CVE-2022-21698
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-cg3q-j54f-5p7p
Release Date: 2022-02-15
Fix Resolution: v1.11.1
Vulnerable Library - github.com/docker/distribution-v2.7.1
The toolkit to pack, ship, store, and deliver container content
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
Yaml in versions v2.2.0 to v2.2.2 is vulnerable to denial of service vector.
Related to decode.go
Publish Date: 2021-04-14
URL: WS-2021-0200
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://osv.dev/vulnerability/GO-2021-0061
Release Date: 2021-04-14
Fix Resolution: v2.2.3
Vulnerable Library - github.com/docker/distribution-v2.7.1
The toolkit to pack, ship, store, and deliver container content
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
Publish Date: 2022-01-01
URL: CVE-2021-44716
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-vc3p-29h2-gpcp
Release Date: 2022-01-01
Fix Resolution: github.com/golang/net - 491a49abca63de5e07ef554052d180a1b5fe2d70
Vulnerable Library - github.com/docker/distribution-v2.7.1
The toolkit to pack, ship, store, and deliver container content
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.
Publish Date: 2020-09-30
URL: CVE-2020-26160
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-26160
Release Date: 2020-09-30
Fix Resolution: v4.0.0-preview1
Vulnerable Library - github.com/docker/distribution-v2.7.1
The toolkit to pack, ship, store, and deliver container content
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
Publish Date: 2017-03-28
URL: CVE-2016-9123
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://osv.dev/vulnerability/GO-2020-0009
Release Date: 2017-03-28
Fix Resolution: v1.0.5
Vulnerable Library - github.com/docker/distribution-v2.7.1
The toolkit to pack, ship, store, and deliver container content
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
Publish Date: 2020-04-01
URL: CVE-2019-11254
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://github.com/go-yaml/yaml/tree/v2.2.8
Release Date: 2020-04-01
Fix Resolution: v2.2.8
Vulnerable Library - github.com/docker/distribution-v2.7.1
The toolkit to pack, ship, store, and deliver container content
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.
Publish Date: 2021-11-17
URL: CVE-2021-41190
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-qq97-vm5h-rrhg
Release Date: 2021-11-17
Fix Resolution: v2.8.0
Vulnerable Library - github.com/kubernetes/apiserver-v0.17.2
Library for writing a Kubernetes-style API server.
Dependency Hierarchy:
Found in HEAD commit: 669793d8de1d48ad154501cdf5541f7589c6003b
Found in base branch: improbable
Vulnerability Details
The Kubernetes API server component in versions prior to 1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via successful API requests.
Publish Date: 2020-03-27
URL: CVE-2020-8552
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8552
Release Date: 2020-03-27
Fix Resolution: v1.18.0-alpha.3
The text was updated successfully, but these errors were encountered: