Open Source Vulnerabilities

opentelemetry-collector-contrib-fips, argo-workflows, metrics-server-fips, metrics-server-fips, metrics-server-fips, amazon-cloudwatch-agent, kaniko, kaniko, prometheus-adapter, tempo, argo-workflows

OpenTelemetry-Go is the Go implementation of OpenTelemetry

opentelemetry-collector-contrib-fips, argo-workflows, grafana-alloy-fips, step-cli, argo-workflows, argo-workflows

filippo

opentelemetry-collector-contrib-fips, argo-workflows, argo-workflows, argo-workflows

Security fix for GHSA-fw7p-63qq-7hpr applied in: opentelemetry-collector-contrib-fips 0.144.0-r1, argo-workflows 3.6.19-r0, argo-workflows 3.6.18-r0, argo-workflows 3.7.10-r0

cassandra-reaper-fips, cassandra-fips

Security fix for GHSA-pr98-23f8-jwxv applied in: cassandra-reaper-fips 3.8.0-r3, cassandra-fips 4.0.19-r2

cassandra-reaper-fips, strimzi-kafka-operator

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients

go-fips-1.25, go-fips-1.25, opentelemetry-collector-contrib-fips, argo-workflows, wazero, stakater-reloader-fips, argo-events, local-static-provisioner-fips, grafana-alloy-fips, mountpoint-s3-csi-driver, multus-cni-fips, kyverno-policy-reporter-kyverno-plugin-fips, mockgen, gostatsd, opensearch-k8s-operator-fips, minio-operator-fips

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succ...

tempo

vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing unauthorized users to obtain the key used to encrypt trace ...

argo-workflows, wazero, stakater-reloader-fips, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, kubernetes-csi-livenessprobe-fips, kyverno-policy-reporter-kyverno-plugin-fips, minio-operator-fips, gostatsd, percona-xtradb-cluster-operator-fips, terragrunt-fips, minio-operator-fips, minio-operator-fips

On Unix platforms, when listing the contents of a directory using File

argo-workflows, wazero, stakater-reloader-fips, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, kubernetes-csi-livenessprobe-fips, kyverno-policy-reporter-kyverno-plugin-fips, gostatsd, percona-xtradb-cluster-operator-fips, terragrunt-fips, minio-operator-fips, minio-operator-fips

Actions which insert URLs into the content attribute of HTML meta tags are not escaped

go-fips-1.25, wazero, stakater-reloader-fips, argo-events, local-static-provisioner-fips, local-static-provisioner-fips, grafana-alloy-fips, multus-cni-fips, kyverno-policy-reporter-kyverno-plugin-fips, gostatsd, opensearch-k8s-operator-fips, minio-operator-fips

archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened

go-fips-1.25, argo-workflows, wazero, stakater-reloader-fips, argo-events, local-static-provisioner-fips, grafana-alloy-fips, multus-cni-fips, kyverno-policy-reporter-kyverno-plugin-fips, gostatsd, opensearch-k8s-operator-fips, minio-operator-fips

net/url package does not set a limit on the number of query parameters in a query

metrics-server-fips, amazon-cloudwatch-agent, kaniko, kaniko, prometheus-adapter, istio-fips

Security fix for GHSA-9h8m-3fm2-qjrq applied in: metrics-server-fips 0.8.1-r3, amazon-cloudwatch-agent 1.300065.0-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, istio-fips 1.28.1-r1

terragrunt-fips, terragrunt-fips, tempo

Security fix for GHSA-6g7g-w4f8-9c9x applied in: terragrunt-fips 0.97.2-r2, terragrunt-fips 0.98.0-r2, tempo 2.9.1-r0

opentelemetry-collector-contrib-fips, amazon-cloudwatch-agent, grafana-alloy-fips, crossplane-provider-azure

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery

prometheus-fips, amazon-cloudwatch-agent, promxy, kaniko, kaniko, prometheus

Moby is an open source container framework

logstash-exporter-fips, argo-workflows, druid-exporter-fips, druid-exporter-fips

Cancelling a query (e

dynamic-localpv-provisioner, lvm-driver, rancher-fleet-agent, argo-workflows, fulcio-fips, fulcio-fips, fulcio-fips, fulcio-fips, fulcio-fips, fluent-operator-fips, litestream, litestream, metrics-server-fips, metrics-server-fips, litestream, litestream, amazon-cloudwatch-agent, litestream, litestream, falco-exporter, k8sgpt-operator, node-problem-detector, kubernetes-dns-node-cache-fips, kaniko, kaniko, prometheus-adapter, yunikorn-k8shim-fips, cert-manager, kubernetes-csi-livenessprobe-fips, minio-operator-fips, terragrunt-fips, tempo

gRPC-Go is the Go language implementation of gRPC

argo-workflows, wazero, stakater-reloader-fips, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, kubernetes-csi-livenessprobe-fips, kyverno-policy-reporter-kyverno-plugin-fips, gostatsd, percona-xtradb-cluster-operator-fips, terragrunt-fips, minio-operator-fips, minio-operator-fips

url

wazero, stakater-reloader-fips, argo-events, local-static-provisioner-fips, grafana-alloy-fips, multus-cni-fips, kyverno-policy-reporter-kyverno-plugin-fips, gostatsd, opensearch-k8s-operator-fips, minio-operator-fips

During the TLS 1

prometheus, tempo

Delete function fails to properly validate offsets when processing malformed JSON input

kubernetes-csi-external-provisioner-fips, lvm-driver, argo-workflows, wazero, stakater-reloader-fips, prometheus-operator, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, paranoia, kubernetes-csi-driver-nfs-fips, kyverno-policy-reporter-kyverno-plugin-fips, mockgen, opentofu-fips, opentofu-fips, jitsucom-bulker, velero-fips

During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions

Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

step-ca, step-ca, fulcio-fips, fulcio-fips, step-ca-fips, trillian-fips, kaniko, kaniko, step-cli, cert-manager, opentofu-fips, opentofu-fips, opentofu-fips, kyverno-fips, velero-fips

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...

thingsboard, thingsboard

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written

stakater-reloader-fips, prometheus-operator, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, prometheus-operator, kubernetes-csi-livenessprobe-fips, kubernetes-csi-driver-nfs-fips, jitsucom-bulker

SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass

kubernetes-csi-external-provisioner-fips, lvm-driver, wazero, stakater-reloader-fips, prometheus-operator, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, paranoia, kubernetes-csi-driver-nfs-fips, kyverno-policy-reporter-kyverno-plugin-fips, opentofu-fips, opentofu-fips, jitsucom-bulker

Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

argo-events, grafana-alloy-fips, kaniko, kaniko, argo-cd, grafana-alloy-fips

Security fix for GHSA-3xc5-wrhm-f963 applied in: argo-events 1.6.3-r1, grafana-alloy-fips 1.15.0-r1, kaniko 1.24.0-r2, argo-cd 3.3.5-r0, grafana-alloy-fips 1.14.2-r1

kubernetes-csi-external-provisioner-fips, lvm-driver, wazero, stakater-reloader-fips, prometheus-operator, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, paranoia, kubernetes-csi-driver-nfs-fips, kyverno-policy-reporter-kyverno-plugin-fips, opentofu-fips, opentofu-fips, jitsucom-bulker

tar

kubernetes-csi-external-provisioner-fips, lvm-driver, wazero, stakater-reloader-fips, prometheus-operator, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, paranoia, kubernetes-csi-driver-nfs-fips, kyverno-policy-reporter-kyverno-plugin-fips, mockgen, opentofu-fips, opentofu-fips, jitsucom-bulker

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources

kubernetes-csi-external-provisioner-fips, lvm-driver, wazero, stakater-reloader-fips, prometheus-operator, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, paranoia, kubernetes-csi-driver-nfs-fips, kyverno-policy-reporter-kyverno-plugin-fips, opentofu-fips, opentofu-fips, jitsucom-bulker

On Linux, if the target of Root

kubernetes-csi-external-provisioner-fips, lvm-driver, argo-workflows, wazero, stakater-reloader-fips, prometheus-operator, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, argo-events, local-static-provisioner-fips, volume-modifier-for-k8s, multus-cni-fips, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, paranoia, kubernetes-csi-driver-nfs-fips, kyverno-policy-reporter-kyverno-plugin-fips, opentofu-fips, opentofu-fips, jitsucom-bulker

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service

ztunnel-fips, ztunnel-fips

Security fix for GHSA-cq8v-f236-94qc applied in: ztunnel-fips 1.27.8-r1, ztunnel-fips 1.27.8-r2

ztunnel-fips

Security fix for GHSA-r6v5-fh4h-64xc applied in: ztunnel-fips 1.27.8-r2

ztunnel-fips, ztunnel-fips, ztunnel-fips

Security fix for GHSA-xgp8-3hg3-c2mh applied in: ztunnel-fips 1.27.8-r1, ztunnel-fips 1.27.8-r2, ztunnel-fips 1.27.8-r3

ztunnel-fips, ztunnel-fips, ztunnel-fips

Security fix for GHSA-965h-392x-2mh5 applied in: ztunnel-fips 1.27.8-r1, ztunnel-fips 1.27.8-r2, ztunnel-fips 1.27.8-r3

ztunnel-fips, ztunnel-fips, ztunnel-fips

Security fix for GHSA-pwjx-qhcg-rvj4 applied in: ztunnel-fips 1.27.8-r1, ztunnel-fips 1.27.8-r2, ztunnel-fips 1.27.8-r3

kubernetes-csi-external-provisioner-fips, lvm-driver, prometheus-operator, k8sgpt, k8sgpt-operator, volume-modifier-for-k8s-fips, consul-k8s-fips, volume-modifier-for-k8s, cert-manager, prometheus-operator, kubernetes-csi-livenessprobe-fips, paranoia, kubernetes-csi-driver-nfs-fips, kyverno-policy-reporter-kyverno-plugin-fips, opentofu-fips, opentofu-fips, jitsucom-bulker

When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

ztunnel-fips, ztunnel-fips

Security fix for GHSA-2gh3-rmm4-6rq5 applied in: ztunnel-fips 1.27.8-r2, ztunnel-fips 1.27.8-r3

ztunnel-fips, ztunnel-fips

Security fix for GHSA-82j2-j2ch-gfr8 applied in: ztunnel-fips 1.27.8-r2, ztunnel-fips 1.27.8-r3

ztunnel-fips, ztunnel-fips

time provides date and time handling in Rust

litestream, litestream, kaniko, kaniko, flux-kustomize-controller-fips, kyverno-policy-reporter-fips, jitsucom-bulker

Security fix for GHSA-xmrv-pmrh-hhx2 applied in: litestream 0.5.14-r1, kaniko 1.24.0-r2, flux-kustomize-controller-fips 1.8.5-r0, kyverno-policy-reporter-fips 3.7.3-r1, jitsucom-bulker 2.10.0-r0

ztunnel-fips, ztunnel-fips

protobuf crate before 3

apache-hive, ztunnel-fips, ztunnel-fips

Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups / series of SGROUP tags can corrupted by exceeding the stack limit i

cosign, metrics-server-fips, metrics-server-fips, metrics-server-fips, amazon-cloudwatch-agent, trillian-fips, kube-logging-operator, kaniko, kaniko, prometheus-adapter, cert-manager, trillian, gotenberg, kyverno-fips, jitsucom-bulker

OpenTelemetry-Go is the Go implementation of OpenTelemetry

cosign, metrics-server-fips, amazon-cloudwatch-agent, trillian-fips, kube-logging-operator, kaniko, kaniko, prometheus-adapter, trillian, gotenberg, kyverno-fips, jitsucom-bulker

Security fix for GHSA-hfvc-g4fc-pqhx applied in: cosign 2.6.4-r1, metrics-server-fips 0.8.1-r3, amazon-cloudwatch-agent 1.300065.0-r1, trillian-fips 1.7.3-r1, kube-logging-operator 6.4.0-r1, kaniko 1.24.0-r2, prometheus-adapter 0.12.0-r1, trillian 1.7.3-r1, gotenberg 8.30.1-r0, kyverno-fips 1.13.6-r9, jitsucom-bulker 2.10.0-r0

step-ca, step-ca, step-ca-fips, trillian-fips, kaniko, kaniko, cert-manager, opentofu-fips, opentofu-fips, opentofu-fips, kyverno-fips, jitsucom-bulker

Security fix for GHSA-78h2-9frx-2jm8 applied in: step-ca 0.30.2-r1, step-ca 0.30.2-r2, step-ca-fips 0.30.2-r1, trillian-fips 1.7.3-r1, kaniko 1.24.0-r2, cert-manager 1.19.4-r1, opentofu-fips 1.9.4-r5, opentofu-fips 1.7.10-r5, opentofu-fips 1.8.11-r5, kyverno-fips 1.13.6-r9, jitsucom-bulker 2.10.0-r0

kuberay-operator, kuberay-operator, lvm-driver, wave, litestream, litestream, litestream, litestream, metrics-server-fips, ip-masq-agent, kserve-rest-proxy, falco-exporter, k8sgpt-operator, kubernetes-dns-node-cache-fips, thanos-operator-fips, mountpoint-s3-csi-driver, opensearch-k8s-operator-fips

html

kuberay-operator, kuberay-operator, lvm-driver, wave, litestream, litestream, litestream, litestream, metrics-server-fips, ip-masq-agent, kserve-rest-proxy, falco-exporter, k8sgpt-operator, kubernetes-dns-node-cache-fips, thanos-operator-fips, mountpoint-s3-csi-driver, opensearch-k8s-operator-fips

html

argo-events, multus-cni-fips, calico-fips, opensearch-k8s-operator-fips

excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

argo-workflows

Security fix for GHSA-48c2-rrv3-qjmp applied in: argo-workflows 3.6.19-r5