kube-webhook-certgen-0.0.4_linux_amd64

digest	sha256:321e434a68754a8449e0b856f0fc5d1f7012933c9ea00a2268b2333ba0e41f3c
vulnerabilities
platform	linux/amd64
size	11 MB
packages	48

golang.org/x/net 0.0.0-20220722155237-a158d28d115b (golang) pkg:golang/golang.org/x/net@0.0.0-20220722155237-a158d28d115b Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') Affected range >=0.0.0-20220524220425-1d687d428aca <0.1.1-0.20221104162952-702349b0e862 Fixed version 0.1.1-0.20221104162952-702349b0e862 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.173% EPSS Percentile 55th percentile Description A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests. Specific Go Packages Affected golang.org/x/net/http2/h2c Affected range <0.0.0-20220906165146-f3363e06e74c Fixed version 0.0.0-20220906165146-f3363e06e74c CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.271% EPSS Percentile 68th percentile Description In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

golang.org/x/text 0.3.7 (golang) pkg:golang/golang.org/x/text@0.3.7 Missing Release of Resource after Effective Lifetime Affected range <0.3.8 Fixed version 0.3.8 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.168% EPSS Percentile 54th percentile Description The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten to fix this behavior for various reasons. Instead the solution implemented in this CL is to limit the total complexity of tags passed into ParseAcceptLanguage by limiting the number of dashes in the string to 1000. This should be more than enough for the majority of real world use cases, where the number of tags being sent is likely to be in the single digits. Specific Go Packages Affected golang.org/x/text/language

stdlib 1.23.1 (golang) pkg:golang/stdlib@1.23.1 Affected range >=1.23.0-0 <1.23.5 Fixed version 1.23.5 EPSS Score 0.045% EPSS Percentile 18th percentile Description A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs. Affected range >=1.23.0-0 <1.23.5 Fixed version 1.23.5 EPSS Score 0.045% EPSS Percentile 18th percentile Description The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2. Affected range >=1.23.0-0 <1.23.6 Fixed version 1.23.6 EPSS Score 0.045% EPSS Percentile 18th percentile Description Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

google.golang.org/protobuf 1.28.0 (golang) pkg:golang/google.golang.org/protobuf@1.28.0 Loop with Unreachable Exit Condition ('Infinite Loop') Affected range <1.33.0 Fixed version 1.33.0 CVSS Score 6.6 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U EPSS Score 0.045% EPSS Percentile 18th percentile Description The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.