| github.com/containers/image allows unexpected authenticated registry accessesCVE-2024-3727 · GHSA-6WVF-F2VW-3425Version ranges need review. |
github.com/containers/image/v5github.com/containers/image |
GoRed Hat |
High
|
Fix reported |
|
| Supplementary groups are not set up properly in github.com/containerd/containerdCVE-2023-25173 · GHSA-HMFX-3PCX-653PVersion ranges need review. |
github.com/containerd/containerdCryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modificationCVE-2022-2990 · GHSA-FJM8-M7M6-2FJPVersion ranges need review. |
github.com/containers/buildahRed Hat Enterprise Linux 7/buildah |
GoRed Hat |
High
|
Fix reported |
|
| Uncontrolled Resource Consumption in promhttpCVE-2022-21698 · GHSA-CG3Q-J54F-5P7PVersion ranges need review. |
github.com/prometheus/client_golangCost Management Metrics Operator/costmanagement-metrics-operator-container |
GoRed Hat |
High
|
Fix reported |
|
| Non-empty default inheritable capabilities for linux container in BuildahCVE-2022-27651 · GHSA-C3G4-W6CV-6V7HVersion ranges need review. |
github.com/containers/buildahRed Hat Enterprise Linux 7/buildah |
GoRed Hat |
Medium
|
Fix reported |
|
| Buildah processes using chroot isolation may leak environment values to intermediate processesCVE-2021-3602 · GHSA-7638-R9R3-RMJJVersion ranges need review. |
github.com/containers/buildahRed Hat Enterprise Linux 7/buildah |
GoRed Hat |
Medium
|
Fix reported |
|
| Memory leaks in code encrypting and verifying RSA payloadsCVE-2024-1394 · GHSA-78HX-GP6G-7MJ6Version ranges need review. |
github.com/golang-fips/gogithub.com/golang-fips/openssl/v2 |
GoRed Hat |
High
|
Fix reported |
|
| containernetworking/cni improper limitation of path nameCVE-2021-20206 · GHSA-XJQR-G762-PXWPVersion ranges need review. |
github.com/containernetworking/cniOpenShift Service Mesh 2.0/servicemesh-cni |
GoRed Hat |
High
|
Fix reported |
|
| Buildah (as part of Podman) vulnerable to Link FollowingCVE-2022-4122 · GHSA-4CRW-W8PW-2HMFVersion ranges need review. |
github.com/containers/podman/v2github.com/containers/podman/v3 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/http2 vulnerable to possible excessive memory growthCVE-2022-41717 · GHSA-XRJJ-MJ9H-534MVersion ranges need review. |
golang.org/x/net/http2golang.org/x/net |
GoRed Hat |
Medium
|
Fix reported |
|
| Denial of service via chunk extensions in net/httpCVE-2023-39326 · GO-2023-2382 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net/http/httpguts vulnerable to Uncontrolled RecursionCVE-2021-31525 · GHSA-H86H-8PPG-MXMHVersion ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Buildah (as part of Podman) vulnerable to Path TraversalCVE-2022-4123 · GHSA-RPRG-4V7Q-87V7Version ranges need review. |
github.com/containers/podman/v4Red Hat Enterprise Linux 7/buildah |
GoRed Hat |
Low
|
No fix reported |
|
| Incorrect operations on the P-224 curve in crypto/ellipticCVE-2021-3114 · GO-2021-0235 |
stdlibOpenShift Serverless/knative-eventing |
GoRed Hat |
Medium
|
Fix reported |
|
| Panic on inputs with large exponents in math/bigCVE-2021-33198 · GO-2021-0242 |
stdlibOpenShift Serverless/knative-eventing |
GoRed Hat |
Medium
|
Fix reported |
|
| Infinite loop when decoding inputs in encoding/xmlCVE-2021-27918 · GO-2021-0234 |
stdlibDistributed Tracing Jaeger 1/distributed-tracing/jaeger-all-in-one-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Improper sanitization when resolving values from DNS in netCVE-2021-33195 · GO-2021-0239 |
stdlibMigration Toolkit for Containers/rhmtc/openshift-migration-controller-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Attacker can drop certain headers in net/http/httputilCVE-2021-33197 · GO-2021-0241 |
stdlibOpenShift Serverless/knative-serving |
GoRed Hat |
Medium
|
Fix reported |
|
| Panic when reading certain archives in archive/zipCVE-2021-33196 · GO-2021-0240 |
stdlibOpenShift Serverless/knative-eventing |
GoRed Hat |
Medium
|
Fix reported |
|
| Panic on certain certificates in crypto/tlsCVE-2021-34558 · GO-2021-0243 |
stdlibOpenShift Pipelines/golang |
GoRed Hat |
Medium
|
Fix reported |
|
