arngrimur / computersaysno Goto Github PK
View Code? Open in Web Editor NEWA small web server that registers request
License: Apache License 2.0
A small web server that registers request
License: Apache License 2.0
The Docker CLI
Dependency Hierarchy:
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: 1a5da3c9c85cd51e447da4c7ce6999697be448a9
Found in base branch: main
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of promhttp.InstrumentHandler*
middleware except RequestsInFlight
; not filter any specific methods (e.g GET) before middleware; pass metric with method
label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown method
. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the method
label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods.
Publish Date: 2022-02-15
URL: CVE-2022-21698
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-cg3q-j54f-5p7p
Release Date: 2022-02-15
Fix Resolution: v1.11.1
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.
Publish Date: 2020-08-05
URL: CVE-2020-15106
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-15106
Release Date: 2020-08-05
Fix Resolution: v3.3.23;v3.4.10
Step up your Open Source Security Game with WhiteSource here
The Docker CLI
Dependency Hierarchy:
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
Publish Date: 2021-01-11
URL: CVE-2021-3121
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121
Release Date: 2021-01-11
Fix Resolution: v1.3.2
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.
Publish Date: 2018-12-14
URL: CVE-2018-16875
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-16875
Release Date: 2018-12-14
Fix Resolution: 1.10.6,1.11.3
Step up your Open Source Security Game with WhiteSource here
The Docker CLI
Dependency Hierarchy:
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during push and pull operations. Documents that contain both “manifests” and “layers” fields could be interpreted as either a manifest or an index in the absence of an accompanying Content-Type header. If a Content-Type header changed between two pulls of the same digest, a client may interpret the resulting content differently. The OCI Distribution Specification has been updated to require that a mediaType value present in a manifest or index match the Content-Type header used during the push and pull operations. Clients pulling from a registry may distrust the Content-Type header and reject an ambiguous document that contains both “manifests” and “layers” fields or “manifests” and “config” fields if they are unable to update to version 1.0.1 of the spec.
Publish Date: 2021-11-17
URL: CVE-2021-41190
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-qq97-vm5h-rrhg
Release Date: 2021-11-17
Fix Resolution: v2.8.0
Step up your Open Source Security Game with WhiteSource here
The Docker CLI
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.
Publish Date: 2020-12-07
URL: CVE-2020-8565
Base Score Metrics:
Type: Upgrade version
Origin: https://osv.dev/vulnerability/GO-2020-0064
Release Date: 2020-12-07
Fix Resolution: v1.20.0-alpha.2
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.
Publish Date: 2020-12-01
URL: CVE-2020-15257
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-36xw-fx78-c5r4
Release Date: 2020-12-01
Fix Resolution: v1.3.9,v1.4.3
Step up your Open Source Security Game with WhiteSource here
[mirror] Go supplementary network libraries
Dependency Hierarchy:
Found in HEAD commit: 8e4b7b20930ec3011f7ac2504deb58c92e4e8b4f
Found in base branch: main
golang.org/x/net before v0.0.0-20210520170846-37e1c6afe023 allows attackers to cause a denial of service (infinite loop) via crafted ParseFragment input.
Publish Date: 2021-05-26
URL: CVE-2021-33194
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33194
Release Date: 2021-05-26
Fix Resolution: golang.org/x/net - v0.0.0-20210520170846-37e1c6afe023
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of containerd prior to 1.4.12 and 1.5.8 treat the Content-Type header as trusted and deserialize the document according to that header. If the Content-Type header changed between pulls of the same ambiguous document (with the same digest), the document may be interpreted differently, meaning that the digest alone is insufficient to unambiguously identify the content of the image.
Publish Date: 2021-11-18
URL: WS-2021-0427
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5j5w-g665-5m35
Release Date: 2021-11-18
Fix Resolution: solidus_core - 2.11.12, 3.0.3, 3.1.3
Step up your Open Source Security Game with WhiteSource here
The Docker CLI
Dependency Hierarchy:
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers.
Publish Date: 2020-12-17
URL: CVE-2020-29652
Base Score Metrics:
Type: Upgrade version
Origin: https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1
Release Date: 2020-12-17
Fix Resolution: v0.0.0-20201216223049-8b5274cf687f
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
containerd is a container runtime. A bug was found in containerd versions prior to 1.4.8 and 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process. This bug has been fixed in containerd 1.5.4 and 1.4.8. As a workaround, ensure that users only pull images from trusted sources. Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with specific files.
Publish Date: 2021-07-19
URL: CVE-2021-32760
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-c72p-9xmj-rx3w
Release Date: 2021-07-19
Fix Resolution: v1.4.8 ,v1.5.4
Step up your Open Source Security Game with WhiteSource here
The Docker CLI
Dependency Hierarchy:
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
There's an input validation flaw in golang.org/x/crypto's readCipherPacket() function. An unauthenticated attacker who sends an empty plaintext packet to a program linked with golang.org/x/crypto/ssh could cause a panic, potentially leading to denial of service.
Publish Date: 2021-11-10
URL: CVE-2021-43565
Base Score Metrics:
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).
Publish Date: 2020-08-05
URL: CVE-2020-15113
Base Score Metrics:
Type: Upgrade version
Origin: etcd-io/etcd@v3.4.9...v3.4.10
Release Date: 2020-07-21
Fix Resolution: 3.4.10, 3.3.23
Step up your Open Source Security Game with WhiteSource here
The Docker CLI
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
Publish Date: 2020-07-22
URL: CVE-2020-8559
Base Score Metrics:
Type: Upgrade version
Origin: kubernetes/kubernetes#92914
Release Date: 2020-07-21
Fix Resolution: v1.18.6,v1.17.9,v1.16.13
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method in wal/wal.go. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime panic when reading the entry.
Publish Date: 2020-08-05
URL: CVE-2020-15112
Base Score Metrics:
Type: Upgrade version
Origin: etcd-io/etcd@v3.4.9...v3.4.10
Release Date: 2020-08-05
Fix Resolution: 3.4.10, 3.3.23
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
containerd is an open source container runtime with an emphasis on simplicity, robustness and portability. A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files. This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability. Users unable to update should limit access to the host to trusted users. Update directory permission on container bundles directories.
Publish Date: 2021-10-04
URL: CVE-2021-41103
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-c2h3-6mxw-7mvq
Release Date: 2021-10-04
Fix Resolution: v1.4.11,v1.5.7
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.
Publish Date: 2019-01-12
URL: CVE-2018-20699
Base Score Metrics:
Type: Upgrade version
Origin: docker/engine#70
Release Date: 2019-01-12
Fix Resolution: v18.09.0
Step up your Open Source Security Game with WhiteSource here
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: c8980a5bef352bb4b9477331dcc940aca400e10b
Found in base branch: main
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
Publish Date: 2021-05-27
URL: CVE-2021-30465
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-c3xm-pvg7-gh7r
Release Date: 2021-05-27
Fix Resolution: v1.0.0-rc95
Step up your Open Source Security Game with WhiteSource here
The Docker CLI
Dependency Hierarchy:
Moby Project - a collaborative project for the container ecosystem to assemble container-based systems
Dependency Hierarchy:
Found in HEAD commit: 8e4b7b20930ec3011f7ac2504deb58c92e4e8b4f
Found in base branch: main
net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
Publish Date: 2021-05-27
URL: CVE-2021-31525
Base Score Metrics:
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1958341
Release Date: 2021-05-27
Fix Resolution: golang - v1.15.12,v1.16.4,v1.17.0
Step up your Open Source Security Game with WhiteSource here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.