105 lines
77 KiB
Markdown
105 lines
77 KiB
Markdown
|
---
|
|||
|
|
hide:
|
|||
|
|
- toc
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
# Security Overview
|
|||
|
|
|
|||
|
|
<link href="https://truecharts.org/_static/trivy.css" type="text/css" rel="stylesheet" />
|
|||
|
|
|
|||
|
|
## Helm-Chart
|
|||
|
|
|
|||
|
|
##### Scan Results
|
|||
|
|
|
|||
|
|
#### Chart Object: grocy/templates/common.yaml
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
| Type | Misconfiguration ID | Check | Severity | Explaination | Links |
|
|||
|
|
|:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------|
|
|||
|
|
| Kubernetes Security Check | KSV001 | Process can elevate its own privileges | MEDIUM | <details><summary>Expand...</summary> A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.allowPrivilegeEscalation' to false </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv001">https://avd.aquasec.com/appshield/ksv001</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW | <details><summary>Expand...</summary> The container should drop all default capabilities and add only those that are needed for its execution. <br> <hr> <br> Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should add 'ALL' to 'securityContext.capabilities.drop' </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/">https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/</a><br><a href="https://avd.aquasec.com/appshield/ksv003">https://avd.aquasec.com/appshield/ksv003</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW | <details><summary>Expand...</summary> The container should drop all default capabilities and add only those that are needed for its execution. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should add 'ALL' to 'securityContext.capabilities.drop' </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/">https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/</a><br><a href="https://avd.aquasec.com/appshield/ksv003">https://avd.aquasec.com/appshield/ksv003</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV011 | CPU not limited | LOW | <details><summary>Expand...</summary> Enforcing CPU limits prevents DoS via resource exhaustion. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'resources.limits.cpu' </details>| <details><summary>Expand...</summary><a href="https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits">https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits</a><br><a href="https://avd.aquasec.com/appshield/ksv011">https://avd.aquasec.com/appshield/ksv011</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM | <details><summary>Expand...</summary> 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. <br> <hr> <br> Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsNonRoot' to true </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv012">https://avd.aquasec.com/appshield/ksv012</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM | <details><summary>Expand...</summary> 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. <br> <hr> <br> Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsNonRoot' to true </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv012">https://avd.aquasec.com/appshield/ksv012</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM | <details><summary>Expand...</summary> 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsNonRoot' to true </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv012">https://avd.aquasec.com/appshield/ksv012</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW | <details><summary>Expand...</summary> An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. <br> <hr> <br> Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.readOnlyRootFilesystem' to true </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/">https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/</a><br><a href="https://avd.aquasec.com/appshield/ksv014">https://avd.aquasec.com/appshield/ksv014</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW | <details><summary>Expand...</summary> An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. <br> <hr> <br> Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.readOnlyRootFilesystem' to true </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/">https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/</a><br><a href="https://avd.aquasec.com/appshield/ksv014">https://avd.aquasec.com/appshield/ksv014</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW | <details><summary>Expand...</summary> An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.readOnlyRootFilesystem' to true </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/">https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/</a><br><a href="https://avd.aquasec.com/appshield/ksv014">https://avd.aquasec.com/appshield/ksv014</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV015 | CPU requests not specified | LOW | <details><summary>Expand...</summary> When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'resources.requests.cpu' </details>| <details><summary>Expand...</summary><a href="https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits">https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits</a><br><a href="https://avd.aquasec.com/appshield/ksv015">https://avd.aquasec.com/appshield/ksv015</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV016 | Memory requests not specified | LOW | <details><summary>Expand...</summary> When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'resources.requests.memory' </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-resources-limits-memory/">https://kubesec.io/basics/containers-resources-limits-memory/</a><br><a href="https://avd.aquasec.com/appshield/ksv016">https://avd.aquasec.com/appshield/ksv016</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV017 | Privileged container | HIGH | <details><summary>Expand...</summary> Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.privileged' to false </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline">https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline</a><br><a href="https://avd.aquasec.com/appshield/ksv017">https://avd.aquasec.com/appshield/ksv017</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV018 | Memory not limited | LOW | <details><summary>Expand...</summary> Enforcing memory limits prevents DoS via resource exhaustion. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'resources.limits.memory' </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-resources-limits-memory/">https://kubesec.io/basics/containers-resources-limits-memory/</a><br><a href="https://avd.aquasec.com/appshield/ksv018">https://avd.aquasec.com/appshield/ksv018</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsUser' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv020">https://avd.aquasec.com/appshield/ksv020</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsUser' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv020">https://avd.aquasec.com/appshield/ksv020</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsUser' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv020">https://avd.aquasec.com/appshield/ksv020</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'RELEASE-NAME-grocy' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsGroup' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv021">https://avd.aquasec.com/appshield/ksv021</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'autopermissions' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsGroup' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv021">https://avd.aquasec.com/appshield/ksv021</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM | <details><summary>Expand...</summary> Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table. <br> <hr> <br> Container 'hostpatch' of Deployment 'RELEASE-NAME-grocy' should set 'securityContext.runAsGroup' > 10000 </details>| <details><summary>Expand...</summary><a href="https://kubesec.io/basics/containers-securitycontext-runasuser/">https://kubesec.io/basics/containers-securitycontext-runasuser/</a><br><a href="https://avd.aquasec.com/appshield/ksv021">https://avd.aquasec.com/appshield/ksv021</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV023 | hostPath volumes mounted | MEDIUM | <details><summary>Expand...</summary> HostPath volumes must be forbidden. <br> <hr> <br> Deployment 'RELEASE-NAME-grocy' should not set 'spec.template.volumes.hostPath' </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline">https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline</a><br><a href="https://avd.aquasec.com/appshield/ksv023">https://avd.aquasec.com/appshield/ksv023</a><br></details> |
|
|||
|
|
| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW | <details><summary>Expand...</summary> Containers should be forbidden from running with a root primary or supplementary GID. <br> <hr> <br> Deployment 'RELEASE-NAME-grocy' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0 </details>| <details><summary>Expand...</summary><a href="https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted">https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted</a><br><a href="https://avd.aquasec.com/appshield/ksv029">https://avd.aquasec.com/appshield/ksv029</a><br></details> |
|
|||
|
|
|
|||
|
|
## Containers
|
|||
|
|
|
|||
|
|
##### Detected Containers
|
|||
|
|
|
|||
|
|
tccr.io/truecharts/alpine:v3.15.2@sha256:29ed3480a0ee43f7af681fed5d4fc215516abf1c41eade6938b26d8c9c2c7583
|
|||
|
|
tccr.io/truecharts/alpine:v3.15.2@sha256:29ed3480a0ee43f7af681fed5d4fc215516abf1c41eade6938b26d8c9c2c7583
|
|||
|
|
tccr.io/truecharts/grocy:v3.3.0@sha256:d21ed09bb95d7d3c134a30b66c4d91e75f8edbb868485910b758b34f3b661a7a
|
|||
|
|
|
|||
|
|
##### Scan Results
|
|||
|
|
|
|||
|
|
|
|||
|
|
#### Container: tccr.io/truecharts/alpine:v3.15.2@sha256:29ed3480a0ee43f7af681fed5d4fc215516abf1c41eade6938b26d8c9c2c7583 (alpine 3.15.2)
|
|||
|
|
|
|||
|
|
|
|||
|
|
**alpine**
|
|||
|
|
|
|||
|
|
|
|||
|
|
| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links |
|
|||
|
|
|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------|
|
|||
|
|
| busybox | CVE-2022-28391 | UNKNOWN | 1.34.1-r4 | 1.34.1-r5 | <details><summary>Expand...</summary><a href="https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch">https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch</a><br><a href="https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch">https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch</a><br><a href="https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661">https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661</a><br></details> |
|
|||
|
|
| ssl_client | CVE-2022-28391 | UNKNOWN | 1.34.1-r4 | 1.34.1-r5 | <details><summary>Expand...</summary><a href="https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch">https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch</a><br><a href="https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch">https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch</a><br><a href="https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661">https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661</a><br></details> |
|
|||
|
|
| zlib | CVE-2018-25032 | HIGH | 1.2.11-r3 | 1.2.12-r0 | <details><summary>Expand...</summary><a href="http://www.openwall.com/lists/oss-security/2022/03/25/2">http://www.openwall.com/lists/oss-security/2022/03/25/2</a><br><a href="http://www.openwall.com/lists/oss-security/2022/03/26/1">http://www.openwall.com/lists/oss-security/2022/03/26/1</a><br><a href="https://access.redhat.com/security/cve/CVE-2018-25032">https://access.redhat.com/security/cve/CVE-2018-25032</a><br><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032</a><br><a href="https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531">https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531</a><br><a href="https://github.com/madler/zlib/compare/v1.2.11...v1.2.12">https://github.com/madler/zlib/compare/v1.2.11...v1.2.12</a><br><a href="https://github.com/madler/zlib/issues/605">https://github.com/madler/zlib/issues/605</a><br><a href="https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4">https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4</a><br><a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5">https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5</a><br><a href="https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ">https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ</a><br><a href="https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html">https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html</a><br><a href="https://nvd.nist.gov/vuln/detail/CVE-2018-25032">https://nvd.nist.gov/vuln/detail/CVE-2018-25032</a><br><a href="https://ubuntu.com/security/notices/USN-5355-1">https://ubuntu.com/security/notices/USN-5355-1</a><br><a href="https://ubuntu.com/security/notices/USN-5355-2">https://ubuntu.com/security/notices/USN-5355-2</a><br><a href="https://ubuntu.com/security/notices/USN-5359-1">https://ubuntu.com/security/notices/USN-5359-1</a><br><a href="https://www.debian.org/security/2022/dsa-5111">https://www.debian.org/security/2022/dsa-5111</a><br><a href="https://www.openwall.com/lists/oss-security/2022/03/24/1">https://www.openwall.com/lists/oss-security/2022/03/24/1</a><br><a href="https://www.openwall.com/lists/oss-security/2022/03/28/1">https://www.openwall.com/lists/oss-security/2022/03/28/1</a><br><a href="https://www.openwall.com/lists/oss-security/2022/03/28/3">https://www.openwall.com/lists/oss-security/2022/03/28/3</a><br></details> |
|
|||
|
|
|
|||
|
|
|
|||
|
|
#### Container: tccr.io/truecharts/alpine:v3.15.2@sha256:29ed3480a0ee43f7af681fed5d4fc215516abf1c41eade6938b26d8c9c2c7583 (alpine 3.15.2)
|
|||
|
|
|
|||
|
|
|
|||
|
|
**alpine**
|
|||
|
|
|
|||
|
|
|
|||
|
|
| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links |
|
|||
|
|
|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------|
|
|||
|
|
| busybox | CVE-2022-28391 | UNKNOWN | 1.34.1-r4 | 1.34.1-r5 | <details><summary>Expand...</summary><a href="https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch">https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch</a><br><a href="https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch">https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch</a><br><a href="https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661">https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661</a><br></details> |
|
|||
|
|
| ssl_client | CVE-2022-28391 | UNKNOWN | 1.34.1-r4 | 1.34.1-r5 | <details><summary>Expand...</summary><a href="https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch">https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch</a><br><a href="https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch">https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch</a><br><a href="https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661">https://gitlab.alpinelinux.org/alpine/aports/-/issues/13661</a><br></details> |
|
|||
|
|
| zlib | CVE-2018-25032 | HIGH | 1.2.11-r3 | 1.2.12-r0 | <details><summary>Expand...</summary><a href="http://www.openwall.com/lists/oss-security/2022/03/25/2">http://www.openwall.com/lists/oss-security/2022/03/25/2</a><br><a href="http://www.openwall.com/lists/oss-security/2022/03/26/1">http://www.openwall.com/lists/oss-security/2022/03/26/1</a><br><a href="https://access.redhat.com/security/cve/CVE-2018-25032">https://access.redhat.com/security/cve/CVE-2018-25032</a><br><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25032</a><br><a href="https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531">https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531</a><br><a href="https://github.com/madler/zlib/compare/v1.2.11...v1.2.12">https://github.com/madler/zlib/compare/v1.2.11...v1.2.12</a><br><a href="https://github.com/madler/zlib/issues/605">https://github.com/madler/zlib/issues/605</a><br><a href="https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4">https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.4</a><br><a href="https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5">https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-v6gp-9mmm-c6p5</a><br><a href="https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ">https://groups.google.com/g/ruby-security-ann/c/vX7qSjsvWis/m/TJWN4oOKBwAJ</a><br><a href="https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html">https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html</a><br><a href="https://nvd.nist.gov/vuln/detail/CVE-2018-25032">https://nvd.nist.gov/vuln/detail/CVE-2018-25032</a><br><a href="https://ubuntu.com/security/notices/USN-5355-1">https://ubuntu.com/security/notices/USN-5355-1</a><br><a href="https://ubuntu.com/security/notices/USN-5355-2">https://ubuntu.com/security/notices/USN-5355-2</a><br><a href="https://ubuntu.com/security/notices/USN-5359-1">https://ubuntu.com/security/notices/USN-5359-1</a><br><a href="https://www.debian.org/security/2022/dsa-5111">https://www.debian.org/security/2022/dsa-5111</a><br><a href="https://www.openwall.com/lists/oss-security/2022/03/24/1">https://www.openwall.com/lists/oss-security/2022/03/24/1</a><br><a href="https://www.openwall.com/lists/oss-security/2022/03/28/1">https://www.openwall.com/lists/oss-security/2022/03/28/1</a><br><a href="https://www.openwall.com/lists/oss-security/2022/03/28/3">https://www.openwall.com/lists/oss-security/2022/03/28/3</a><br></details> |
|
|||
|
|
|
|||
|
|
|
|||
|
|
#### Container: Node.js
|
|||
|
|
|
|||
|
|
|
|||
|
|
**node-pkg**
|
|||
|
|
|
|||
|
|
|
|||
|
|
| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links |
|
|||
|
|
|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------|
|
|||
|
|
| bootbox | GHSA-87mg-h5r3-hw88 | MEDIUM | 5.5.2 | | <details><summary>Expand...</summary><a href="https://github.com/advisories/GHSA-87mg-h5r3-hw88">https://github.com/advisories/GHSA-87mg-h5r3-hw88</a><br><a href="https://github.com/makeusabrew/bootbox/issues/661">https://github.com/makeusabrew/bootbox/issues/661</a><br><a href="https://hackerone.com/reports/508446">https://hackerone.com/reports/508446</a><br><a href="https://www.npmjs.com/advisories/882">https://www.npmjs.com/advisories/882</a><br></details> |
|
|||
|
|
| bootstrap | CVE-2018-14041 | MEDIUM | 4.0.0 | 4.1.2, 3.4.0 | <details><summary>Expand...</summary><a href="http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html">http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html</a><br><a href="http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html">http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html</a><br><a href="http://seclists.org/fulldisclosure/2019/May/10">http://seclists.org/fulldisclosure/2019/May/10</a><br><a href="http://seclists.org/fulldisclosure/2019/May/11">http://seclists.org/fulldisclosure/2019/May/11</a><br><a href="http://seclists.org/fulldisclosure/2019/May/13">http://seclists.org/fulldisclosure/2019/May/13</a><br><a href="https://access.redhat.com/errata/RHSA-2019:1456">https://access.redhat.com/errata/RHSA-2019:1456</a><br><a href="https://access.redhat.com/security/cve/CVE-2018-14041">https://access.redhat.com/security/cve/CVE-2018-14041</a><br><a href="https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/">https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/</a><br><a href="https://github.com/advisories/GHSA-pj7m-g53m-7638">https://github.com/advisories/GHSA-pj7m-g53m-7638</a><br><a href="https://github.com/twbs/bootstrap/issues/26423">https://github.com/twbs/bootstrap/issues/26423</a><br><a href="https://github.com/twbs/bootstrap/issues/26627">https://github.com/twbs/bootstrap/issues/26627</a><br><a href="https://github.com/twbs/bootstrap/pull/26630">https://github.com/twbs/bootstrap/pull/26630</a><br><a href="https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E">https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3Cdev.superset.apache.org%3E">https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3Cdev.superset.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E">https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E">https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714@%3Cissues.hbase.apache.org%3E">https://lists.apache.org/thread.html/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714@%3Cissues.hbase.apache.org%3E</a><br><a href="https://nvd.nist.gov/vuln/detail/CVE-2018-14041">https://nvd.nist.gov/vuln/detail/CVE-2018-14041</a><br><a href="https://seclists.org/bugtraq/2019/May/18">https://seclists.org/bugtraq/2019/May/18</a><br><a href="https://typo3.org/security/advisory/typo3-core-sa-2019-006">https://typo3.org/security/advisory/typo3-core-sa-2019-006</a><br><a href="https://www.oracle.com/security-alerts/cpuApr2021.html">https://www.oracle.com/security-alerts/cpuApr2021.html</a><br></details> |
|
|||
|
|
| bootstrap | CVE-2019-8331 | MEDIUM | 4.0.0 | 3.4.1, 4.3.1 | <details><summary>Expand...</summary><a href="http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html">http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html</a><br><a href="http://seclists.org/fulldisclosure/2019/May/10">http://seclists.org/fulldisclosure/2019/May/10</a><br><a href="http://seclists.org/fulldisclosure/2019/May/11">http://seclists.org/fulldisclosure/2019/May/11</a><br><a href="http://seclists.org/fulldisclosure/2019/May/13">http://seclists.org/fulldisclosure/2019/May/13</a><br><a href="http://www.securityfocus.com/bid/107375">http://www.securityfocus.com/bid/107375</a><br><a href="https://access.redhat.com/errata/RHSA-2019:1456">https://access.redhat.com/errata/RHSA-2019:1456</a><br><a href="https://access.redhat.com/errata/RHSA-2019:3023">https://access.redhat.com/errata/RHSA-2019:3023</a><br><a href="https://access.redhat.com/errata/RHSA-2019:3024">https://access.redhat.com/errata/RHSA-2019:3024</a><br><a href="https://access.redhat.com/security/cve/CVE-2019-8331">https://access.redhat.com/security/cve/CVE-2019-8331</a><br><a href="https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/">https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/</a><br><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8331">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8331</a><br><a href="https://github.com/advisories/GHSA-9v3m-8fp8-mj99">https://github.com/advisories/GHSA-9v3m-8fp8-mj99</a><br><a href="https://github.com/twbs/bootstrap-sass/releases/tag/v3.4.1">https://github.com/twbs/bootstrap-sass/releases/tag/v3.4.1</a><br><a href="https://github.com/twbs/bootstrap/pull/28236">https://github.com/twbs/bootstrap/pull/28236</a><br><a href="https://github.com/twbs/bootstrap/releases/tag/v3.4.1">https://github.com/twbs/bootstrap/releases/tag/v3.4.1</a><br><a href="https://github.com/twbs/bootstrap/releases/tag/v4.3.1">https://github.com/twbs/bootstrap/releases/tag/v4.3.1</a><br><a href="https://linux.oracle.com/cve/CVE-2019-8331.html">https://linux.oracle.com/cve/CVE-2019-8331.html</a><br><a href="https://linux.oracle.com/errata/ELSA-2020-4847.html">https://linux.oracle.com/errata/ELSA-2020-4847.html</a><br><a href="https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E">https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E">https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E">https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E">https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3Cdev.superset.apache.org%3E">https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3Cdev.superset.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E">https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E">https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9
|
|||
|
|
| chart.js | CVE-2020-7746 | HIGH | 2.7.1 | 2.9.4 | <details><summary>Expand...</summary><a href="https://github.com/advisories/GHSA-h68q-55jf-x68w">https://github.com/advisories/GHSA-h68q-55jf-x68w</a><br><a href="https://github.com/chartjs/Chart.js/pull/7920">https://github.com/chartjs/Chart.js/pull/7920</a><br><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-7746">https://nvd.nist.gov/vuln/detail/CVE-2020-7746</a><br><a href="https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1019375">https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1019375</a><br><a href="https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCHARTJS-1019376">https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBCHARTJS-1019376</a><br><a href="https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1019374">https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1019374</a><br><a href="https://snyk.io/vuln/SNYK-JS-CHARTJS-1018716">https://snyk.io/vuln/SNYK-JS-CHARTJS-1018716</a><br></details> |
|
|||
|
|
| datatables.net | CVE-2020-28458 | HIGH | 1.10.16 | 1.10.22 | <details><summary>Expand...</summary><a href="https://access.redhat.com/security/cve/CVE-2020-28458">https://access.redhat.com/security/cve/CVE-2020-28458</a><br><a href="https://github.com/DataTables/DataTablesSrc/commit/a51cbe99fd3d02aa5582f97d4af1615d11a1ea03">https://github.com/DataTables/DataTablesSrc/commit/a51cbe99fd3d02aa5582f97d4af1615d11a1ea03</a><br><a href="https://github.com/DataTables/Dist-DataTables/blob/master/js/jquery.dataTables.js%23L2766">https://github.com/DataTables/Dist-DataTables/blob/master/js/jquery.dataTables.js%23L2766</a><br><a href="https://github.com/advisories/GHSA-m7j4-fhg6-xf5v">https://github.com/advisories/GHSA-m7j4-fhg6-xf5v</a><br><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-28458">https://nvd.nist.gov/vuln/detail/CVE-2020-28458</a><br><a href="https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1051961">https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1051961</a><br><a href="https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1051962">https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1051962</a><br><a href="https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402">https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402</a><br><a href="https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806">https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806</a><br></details> |
|
|||
|
|
| datatables.net | CVE-2021-23445 | MEDIUM | 1.10.16 | 1.11.3 | <details><summary>Expand...</summary><a href="https://cdn.datatables.net/1.11.3/">https://cdn.datatables.net/1.11.3/</a><br><a href="https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b">https://github.com/DataTables/Dist-DataTables/commit/59a8d3f8a3c1138ab08704e783bc52bfe88d7c9b</a><br><a href="https://github.com/advisories/GHSA-h73q-5wmj-q8pj">https://github.com/advisories/GHSA-h73q-5wmj-q8pj</a><br><a href="https://nvd.nist.gov/vuln/detail/CVE-2021-23445">https://nvd.nist.gov/vuln/detail/CVE-2021-23445</a><br><a href="https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371">https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1715371</a><br><a href="https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376">https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1715376</a><br><a href="https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544">https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544</a><br></details> |
|
|||
|
|
| jquery | CVE-2019-11358 | MEDIUM | 3.3.1 | >=3.4.0 | <details><summary>Expand...</summary><a href="http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html">http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00006.html</a><br><a href="http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html">http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00025.html</a><br><a href="http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html">http://packetstormsecurity.com/files/152787/dotCMS-5.1.1-Vulnerable-Dependencies.html</a><br><a href="http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html">http://packetstormsecurity.com/files/153237/RetireJS-CORS-Issue-Script-Execution.html</a><br><a href="http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html">http://packetstormsecurity.com/files/156743/OctoberCMS-Insecure-Dependencies.html</a><br><a href="http://seclists.org/fulldisclosure/2019/May/10">http://seclists.org/fulldisclosure/2019/May/10</a><br><a href="http://seclists.org/fulldisclosure/2019/May/11">http://seclists.org/fulldisclosure/2019/May/11</a><br><a href="http://seclists.org/fulldisclosure/2019/May/13">http://seclists.org/fulldisclosure/2019/May/13</a><br><a href="http://www.openwall.com/lists/oss-security/2019/06/03/2">http://www.openwall.com/lists/oss-security/2019/06/03/2</a><br><a href="http://www.securityfocus.com/bid/108023">http://www.securityfocus.com/bid/108023</a><br><a href="https://access.redhat.com/errata/RHBA-2019:1570">https://access.redhat.com/errata/RHBA-2019:1570</a><br><a href="https://access.redhat.com/errata/RHSA-2019:1456">https://access.redhat.com/errata/RHSA-2019:1456</a><br><a href="https://access.redhat.com/errata/RHSA-2019:2587">https://access.redhat.com/errata/RHSA-2019:2587</a><br><a href="https://access.redhat.com/errata/RHSA-2019:3023">https://access.redhat.com/errata/RHSA-2019:3023</a><br><a href="https://access.redhat.com/errata/RHSA-2019:3024">https://access.redhat.com/errata/RHSA-2019:3024</a><br><a href="https://access.redhat.com/security/cve/CVE-2019-11358">https://access.redhat.com/security/cve/CVE-2019-11358</a><br><a href="https://backdropcms.org/security/backdrop-sa-core-2019-009">https://backdropcms.org/security/backdrop-sa-core-2019-009</a><br><a href="https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/">https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/</a><br><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358</a><br><a href="https://github.com/DanielRuf/snyk-js-jquery-174006?files=1">https://github.com/DanielRuf/snyk-js-jquery-174006?files=1</a><br><a href="https://github.com/advisories/GHSA-6c3j-c64m-qhgq">https://github.com/advisories/GHSA-6c3j-c64m-qhgq</a><br><a href="https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b">https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b</a><br><a href="https://github.com/jquery/jquery/pull/4333">https://github.com/jquery/jquery/pull/4333</a><br><a href="https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#434">https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#434</a><br><a href="https://hackerone.com/reports/454365">https://hackerone.com/reports/454365</a><br><a href="https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601">https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44601</a><br><a href="https://linux.oracle.com/cve/CVE-2019-11358.html">https://linux.oracle.com/cve/CVE-2019-11358.html</a><br><a href="https://linux.oracle.com/errata/ELSA-2020-4847.html">https://linux.oracle.com/errata/ELSA-2020-4847.html</a><br><a href="https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E">https://lists.apache.org/thread.html/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc@%3Ccommits.airflow.apache.org%3E
|
|||
|
|
| jquery | CVE-2020-11022 | MEDIUM | 3.3.1 | 3.5.0 | <details><summary>Expand...</summary><a href="http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html">http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html</a><br><a href="http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html">http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html</a><br><a href="http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html">http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html</a><br><a href="http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html">http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html</a><br><a href="https://access.redhat.com/security/cve/CVE-2020-11022">https://access.redhat.com/security/cve/CVE-2020-11022</a><br><a href="https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/">https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/</a><br><a href="https://github.com/advisories/GHSA-gxr4-xjj5-5px2">https://github.com/advisories/GHSA-gxr4-xjj5-5px2</a><br><a href="https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77">https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77</a><br><a href="https://github.com/jquery/jquery/releases/tag/3.5.0">https://github.com/jquery/jquery/releases/tag/3.5.0</a><br><a href="https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2">https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2</a><br><a href="https://jquery.com/upgrade-guide/3.5/">https://jquery.com/upgrade-guide/3.5/</a><br><a href="https://linux.oracle.com/cve/CVE-2020-11022.html">https://linux.oracle.com/cve/CVE-2020-11022.html</a><br><a href="https://linux.oracle.com/errata/ELSA-2022-9177.html">https://linux.oracle.com/errata/ELSA-2022-9177.html</a><br><a href="https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E">https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E">https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48@%3Cissues.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E">https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae@%3Cissues.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3E">https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760@%3Cissues.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3E">https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d@%3Cissues.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3E">https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c@%3Cissues.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3E">https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67@%3Cdev.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3E">https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133@%3Ccommits.airflow.apache.org%3E</a><br><a hr
|
|||
|
|
| jquery | CVE-2020-11023 | MEDIUM | 3.3.1 | 3.5.0 | <details><summary>Expand...</summary><a href="http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html">http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html</a><br><a href="http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html">http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html</a><br><a href="http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html">http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html</a><br><a href="http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html">http://packetstormsecurity.com/files/162160/jQuery-1.0.3-Cross-Site-Scripting.html</a><br><a href="https://access.redhat.com/security/cve/CVE-2020-11023">https://access.redhat.com/security/cve/CVE-2020-11023</a><br><a href="https://blog.jquery.com/2020/04/10/jquery-3-5-0-released">https://blog.jquery.com/2020/04/10/jquery-3-5-0-released</a><br><a href="https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/">https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/</a><br><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023</a><br><a href="https://github.com/advisories/GHSA-jpcq-cgw6-v4j6">https://github.com/advisories/GHSA-jpcq-cgw6-v4j6</a><br><a href="https://github.com/jquery/jquery/releases/tag/3.5.0">https://github.com/jquery/jquery/releases/tag/3.5.0</a><br><a href="https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6">https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6</a><br><a href="https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440">https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440</a><br><a href="https://jquery.com/upgrade-guide/3.5/">https://jquery.com/upgrade-guide/3.5/</a><br><a href="https://linux.oracle.com/cve/CVE-2020-11023.html">https://linux.oracle.com/cve/CVE-2020-11023.html</a><br><a href="https://linux.oracle.com/errata/ELSA-2022-9177.html">https://linux.oracle.com/errata/ELSA-2022-9177.html</a><br><a href="https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E">https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36@%3Cissues.flink.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb@%3Cissues.hive.apache.org%3E">https://lists.apache.org/thread.html/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb@%3Cissues.hive.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6@%3Cdev.felix.apache.org%3E">https://lists.apache.org/thread.html/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6@%3Cdev.felix.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec@%3Cissues.hive.apache.org%3E">https://lists.apache.org/thread.html/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec@%3Cissues.hive.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c@%3Cgitbox.hive.apache.org%3E">https://lists.apache.org/thread.html/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c@%3Cgitbox.hive.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330@%3Cdev.felix.apache.org%3E">https://lists.apache.org/thread.html/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330@%3Cdev.felix.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef@%3Cdev.felix.apache.org%3E">https://lists.apache.org/thread.html/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef@%3Cdev.felix.apache.org%3E</a><br><a href="https://lists.apache.org/thread.html/r4
|
|||
|
|
| moment | CVE-2017-18214 | HIGH | 2.18.1 | 2.19.3 | <details><summary>Expand...</summary><a href="https://access.redhat.com/security/cve/CVE-2017-18214">https://access.redhat.com/security/cve/CVE-2017-18214</a><br><a href="https://github.com/advisories/GHSA-446m-mv8f-q348">https://github.com/advisories/GHSA-446m-mv8f-q348</a><br><a href="https://github.com/moment/moment/issues/4163">https://github.com/moment/moment/issues/4163</a><br><a href="https://github.com/moment/moment/pull/4326">https://github.com/moment/moment/pull/4326</a><br><a href="https://nodesecurity.io/advisories/532">https://nodesecurity.io/advisories/532</a><br><a href="https://nvd.nist.gov/vuln/detail/CVE-2017-18214">https://nvd.nist.gov/vuln/detail/CVE-2017-18214</a><br><a href="https://www.npmjs.com/advisories/532">https://www.npmjs.com/advisories/532</a><br><a href="https://www.tenable.com/security/tns-2019-02">https://www.tenable.com/security/tns-2019-02</a><br></details> |
|
|||
|
|
| moment | CVE-2022-24785 | HIGH | 2.18.1 | 2.29.2 | <details><summary>Expand...</summary><a href="https://access.redhat.com/security/cve/CVE-2022-24785">https://access.redhat.com/security/cve/CVE-2022-24785</a><br><a href="https://github.com/advisories/GHSA-8hfj-j24r-96c4">https://github.com/advisories/GHSA-8hfj-j24r-96c4</a><br><a href="https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5">https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5</a><br><a href="https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4">https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4</a><br><a href="https://nvd.nist.gov/vuln/detail/CVE-2022-24785">https://nvd.nist.gov/vuln/detail/CVE-2022-24785</a><br></details> |
|
|||
|
|
|
|||
|
|
**composer**
|
|||
|
|
|
|||
|
|
|
|||
|
|
| No Vulnerabilities found |
|
|||
|
|
|:---------------------------------|
|