We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
What happened:
These CVEs are low severity in terms of impact, but customers do run scans on these images and will raise support requests:
go.mod (gomod) ============== Total: 4 (HIGH: 4) ┌─────────────────────────────┬────────────────┬──────────┬───────────────────────────────────┬───────────────────────────────────┬─────────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Installed Version │ Fixed Version │ Title │ ├─────────────────────────────┼────────────────┼──────────┼───────────────────────────────────┼───────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ github.com/dgrijalva/jwt-go │ CVE-2020-26160 │ HIGH │ 3.2.0+incompatible │ │ jwt-go: access restriction bypass vulnerability │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2020-26160 │ ├─────────────────────────────┼────────────────┤ ├───────────────────────────────────┼───────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ golang.org/x/net │ CVE-2022-27664 │ │ 0.0.0-20220617184016-355a448f1bc9 │ 0.0.0-20220906165146-f3363e06e74c │ golang: net/http: handle server errors after sending GOAWAY │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-27664 │ ├─────────────────────────────┼────────────────┤ ├───────────────────────────────────┼───────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ golang.org/x/text │ CVE-2022-32149 │ │ 0.3.7 │ 0.3.8 │ golang: golang.org/x/text/language: ParseAcceptLanguage │ │ │ │ │ │ │ takes a long time to parse complex tags │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-32149 │ ├─────────────────────────────┼────────────────┤ ├───────────────────────────────────┼───────────────────────────────────┼─────────────────────────────────────────────────────────────┤ │ gopkg.in/yaml.v3 │ CVE-2022-28948 │ │ 3.0.0 │ 3.0.1 │ golang-gopkg-yaml: crash when attempting to deserialize │ │ │ │ │ │ │ invalid input │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-28948 │ └─────────────────────────────┴────────────────┴──────────┴───────────────────────────────────┴───────────────────────────────────┴─────────────────────────────────────────────────────────────┘
In general, bumping to the latest /x packages is recommended.
Anything else we need to know?:
Environment:
clusterctl version
kubectl version
docker info
/etc/os-release
The text was updated successfully, but these errors were encountered:
Successfully merging a pull request may close this issue.
What happened:
These CVEs are low severity in terms of impact, but customers do run scans on these images and will raise support requests:
In general, bumping to the latest /x packages is recommended.
Anything else we need to know?:
Environment:
clusterctl version
): N/Akubectl version
): N/Adocker info
): N/A/etc/os-release
): N/AThe text was updated successfully, but these errors were encountered: