Open Source Vulnerabilities

unzip

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6

unzip

Info-ZIP UnZip 6

unzip

Info-ZIP UnZip 6

falcosidekick, falcosidekick-fips

Security fix for GHSA-v23v-6jw2-98fq applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0

unzip

flaw was found in Unzip

unzip

flaw was found in Unzip

unzip

flaw was found in unzip

grafana, grafana, grafana, grafana-fips, grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

falcosidekick, falcosidekick-fips, trivy

Security fix for GHSA-cgrx-mc8f-2prm applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0, trivy 0.67.2-r0

mlflow

mlflow

mlflow

mlflow

py3-werkzeug

Werkzeug is a Web Server Gateway Interface web application library

py3-werkzeug

Werkzeug is a comprehensive WSGI web application library

falcosidekick, falcosidekick-fips, trivy

Security fix for GHSA-pwhc-rpq9-4c8w applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0, trivy 0.67.2-r0

py3-werkzeug

Improper parsing of HTTP requests in Pallets Werkzeug v2

grafana, grafana, grafana, grafana, grafana, grafana-fips, grafana, grafana

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar

falcosidekick, falcosidekick-fips

Security fix for GHSA-265r-hfxg-fhmg applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0

falcosidekick, falcosidekick-fips, trivy

Security fix for GHSA-m6hq-p25p-ffr2 applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0, trivy 0.67.2-r0

debezium-3.7-connector-mariadb, debezium-3.7-connector-mariadb

debezium-3.7-connector-mariadb, debezium-3.7-connector-mariadb

debezium-3.7-connector-mariadb, debezium-3.7-connector-mariadb

debezium-3.7-connector-mariadb, debezium-3.7-connector-mariadb

debezium-3.7-connector-mariadb, debezium-3.7-connector-mariadb

kserve-huggingfaceserver-cuda-13.3

kserve-huggingfaceserver-cuda-13.3

kserve-huggingfaceserver-cuda-13.3

kserve-huggingfaceserver-cuda-13.3

falcosidekick, falcosidekick-fips

Security fix for GHSA-x84c-p2g9-rqv9 applied in: falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0

step-cli, nats-server-config-reloader-fips, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-config-reloader-fips, nats-server-fips, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-config-reloader-fips, nats-server-config-reloader-fips, nats-server-fips, grafana, nats-server-config-reloader-fips, grafana, grafana, kyverno-policy-reporter-ui-fips

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

falcoctl-fips, falcosidekick, falcosidekick-fips

Security fix for GHSA-4vq8-7jfc-9cvp applied in: falcoctl-fips 0.11.0-r0, falcosidekick 2.32.0-r0, falcosidekick-fips 2.32.0-r0

coredns-fips, step-cli, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-config-reloader-fips, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, nats-server-config-reloader-fips, nats-server-config-reloader-fips, grafana, nats-server-config-reloader-fips, nats-server-fips, grafana, grafana, kyverno-policy-reporter-ui-fips, grafana

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

opensearch-dashboards-2-fips-dashboards-reporting

coredns-fips, step-cli, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, nats-server-config-reloader-fips, nats-server-config-reloader-fips, grafana, nats-server-fips, grafana, grafana, kyverno-policy-reporter-ui-fips, grafana

tar

opentofu, trivy, grafana, grafana, grafana-fips, grafana, grafana-fips, grafana-fips, grafana, grafana, loki, loki, grafana, grafana

Security fix for GHSA-xmrv-pmrh-hhx2 applied in: opentofu 1.11.13-r1, trivy 0.69.3-r1, grafana 12.2.8-r1, grafana 12.3.6-r0, grafana-fips 12.2.8-r0, grafana 12.1.10-r3, grafana-fips 12.3.6-r0, grafana-fips 13.0.0-r0, grafana 12.0.10-r2, grafana 12.1.7-r2, loki 3.6.10-r1, grafana 12.2.5-r1, grafana 12.4.2-r0

nats-server-fips, falcosidekick, falcosidekick-fips

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", "

traefik, opentofu, opentofu, opentofu, grafana, grafana, grafana, gatekeeper, gatekeeper-fips, grafana, grafana, grafana, grafana, grafana, grafana-fips, grafana, grafana-fips, loki, loki, grafana, grafana

OpenTelemetry-Go is the Go implementation of OpenTelemetry

falcosidekick, falcosidekick-fips

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information

step-cli, nats-server-config-reloader-fips, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-fips, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, grafana, grafana, grafana, kyverno-policy-reporter-ui-fips, grafana

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

grafana, trivy, grafana

go-git is an extensible git implementation library written in pure Go

consul-k8s, consul, step-cli, traefik, grafana, trivy, grafana, grafana, minio, grafana-fips, grafana, grafana-fips, loki, loki, grafana, grafana, grafana, grafana

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

grafana, trivy, grafana

go-git is an extensible git implementation library written in pure Go

grafana-fips, grafana, grafana, grafana

Delete function fails to properly validate offsets when processing malformed JSON input

coredns-fips, nats-server-config-reloader-fips, etcd, grafana, grafana, trivy, consul, nats-server-fips, nats-server-fips, nats-server-fips, nats-server-fips, grafana, grafana, grafana, grafana

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

falcosidekick, falcosidekick-fips

go command may execute unexpected commands when operating in untrusted VCS repositories

falcosidekick, falcosidekick-fips

net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines

coredns-fips, step-cli, nats-server-config-reloader-fips, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-fips, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-config-reloader-fips, nats-server-fips, grafana, grafana, grafana, kyverno-policy-reporter-ui-fips, grafana

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

coredns-fips, step-cli, nats-server-config-reloader-fips, trivy, consul, gatekeeper, gatekeeper-fips, grafana, grafana, nats-server-config-reloader-fips, nats-server-fips, nats-server-fips, newrelic-k8s-metadata-injection, nats-server-fips, nats-server-config-reloader-fips, nats-server-config-reloader-fips, grafana, nats-server-config-reloader-fips, nats-server-fips, grafana, grafana, kyverno-policy-reporter-ui-fips, grafana

On Linux, if the target of Root

kyverno-policy-reporter-ui

Security fix for GHSA-47m2-4cr7-mhcw applied in: kyverno-policy-reporter-ui 2.4.4-r0