| HTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325 · GHSA-4374-P667-P6C8Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| github.com/containers/image allows unexpected authenticated registry accessesCVE-2024-3727 · GHSA-6WVF-F2VW-3425Version ranges need review. |
github.com/containers/image/v5github.com/containers/image |
GoRed Hat |
High
|
Fix reported |
|
| Kubernetes allows bypassing mountable secrets policy imposed by the ServiceAccount admission pluginCVE-2024-3177 · GHSA-PXHW-596R-RWQ5Version ranges need review. |
k8s.io/kubernetesRed Hat OpenShift Container Platform 3.11/atomic-openshift |
GoRed Hat |
Low
|
Fix reported |
|
| Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)CVE-2024-28180 · GHSA-C5Q2-7R4C-MV6GVersion ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| runc AppArmor bypass with symlinked /procCVE-2023-28642 · GHSA-G2J6-57V7-GM8CVersion ranges need review. |
github.com/opencontainers/runcRed Hat Enterprise Linux 7/runc |
GoRed Hat |
Medium
|
Fix reported |
|
| Improper rendering of text nodes in golang.org/x/net/htmlCVE-2023-3978 · GHSA-2WRH-6PVC-2JM9Version ranges need review. |
golang.org/x/netOpenShift API for Data Protection/oadp/oadp-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| kube-apiserver vulnerable to policy bypassCVE-2023-2727 · GHSA-QC2G-GMH6-95P4Version ranges need review. |
k8s.io/kubernetesRed Hat OpenShift Container Platform 3.11/atomic-openshift |
GoRed Hat |
Medium
|
Fix reported |
|
| Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka TerrapinCVE-2023-48795 · GHSA-45X7-PX36-X8W8Version ranges need review. |
russhgolang.org/x/crypto |
Rust / CargoGoPyPIRed Hat |
Medium
|
Fix reported |
|
| Kubernetes mountable secrets policy bypassCVE-2023-2728 · GHSA-CGCV-5272-97PRVersion ranges need review. |
k8s.io/kubernetesRed Hat OpenShift Container Platform 3.11/atomic-openshift |
GoRed Hat |
Medium
|
Fix reported |
|
| Opencontainers runc Incorrect Authorization vulnerabilityCVE-2023-27561 · GHSA-VPVM-3WQ2-2WVMVersion ranges need review. |
github.com/opencontainers/runcRed Hat Enterprise Linux 7/runc |
GoRed Hat |
High
|
Fix reported |
|
| rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runcCVE-2023-25809 · GHSA-M8CG-XC2P-R3FCVersion ranges need review. |
github.com/opencontainers/runcRed Hat Enterprise Linux 7/runc |
GoRed Hat |
Low
|
Fix reported |
|
| Supplementary groups are not set up properly in github.com/containerd/containerdCVE-2023-25173 · GHSA-HMFX-3PCX-653PVersion ranges need review. |
github.com/containerd/containerdCryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Kubernetes client-go vulnerable to Sensitive Information Leak via Log FileCVE-2020-8565 · GHSA-8CFG-VX93-JVXWVersion ranges need review. |
k8s.io/client-gok8s.io/kubernetes |
GoRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/text/language Out-of-bounds Read vulnerabilityCVE-2021-38561 · GHSA-PPP9-7JFF-5VJ2Version ranges need review. |
golang.org/x/textOpenShift Developer Tools and Services/odo |
GoRed Hat |
High
|
Fix reported |
|
| Authorization Bypass Through User-Controlled Key in go-restfulCVE-2022-1996 · GHSA-R48Q-9G5R-8Q2HVersion ranges need review. |
github.com/emicklei/go-restful/v2github.com/emicklei/go-restful/v3 |
GoRed Hat |
Critical
|
Fix reported |
|
| yaml package for Go can consume excessive amounts of CPU or memoryCVE-2022-3064 · GHSA-6Q6Q-88XP-6F2RVersion ranges need review. |
gopkg.in/yaml.v2Cryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/text/language Denial of service via crafted Accept-Language headerCVE-2022-32149 · GHSA-69CH-W2M2-3VJPVersion ranges need review. |
golang.org/x/textOpenShift Developer Tools and Services/odo |
GoRed Hat |
High
|
Fix reported |
|
| x/crypto/ssh vulnerable to panic via malformed packetsCVE-2021-43565 · GHSA-GWC9-M7RH-J2WWVersion ranges need review. |
golang.org/x/cryptoMigration Toolkit for Containers/rhmtc/openshift-migration-velero-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto/ssh NULL Pointer Dereference vulnerabilityCVE-2020-29652 · GHSA-3VM4-22FP-5RFMVersion ranges need review. |
golang.org/x/cryptoOpenShift Service Mesh 2.0/3scale-istio-adapter-rhel8-container |
GoRed Hat |
High
|
Fix reported |
|
| Uncontrolled Resource Consumption in promhttpCVE-2022-21698 · GHSA-CG3Q-J54F-5P7PVersion ranges need review. |
github.com/prometheus/client_golangCost Management Metrics Operator/costmanagement-metrics-operator-container |
GoRed Hat |
High
|
Fix reported |
|
