Skip to main content
New to Testkube? Unleash the power of cloud native testing in Kubernetes with Testkube. Get Started >

prometheus-nats-exporter-0.15.0_linux_amd64

digestsha256:93e1c538e6434d6809c403904c8c148e804b5aeaac791a2733439b5ae2e098b4
vulnerabilitiescritical: 2 high: 5 medium: 6 low: 0 unspecified: 5
size7.3 MB
packages40
critical: 1 high: 4 medium: 1 low: 0 unspecified: 2stdlib 1.22.2 (golang)

pkg:golang/stdlib@1.22.2

# Dockerfile (38:38)
COPY --from=deps /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

critical : CVE--2024--24790

Affected range
>=1.22.0-0
<1.22.4
Fixed version1.22.4
EPSS Score0.06%
EPSS Percentile28th percentile
Description

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

high : CVE--2024--34158

Affected range<1.22.7
Fixed version1.22.7
EPSS Score0.04%
EPSS Percentile17th percentile
Description

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

high : CVE--2024--34156

Affected range<1.22.7
Fixed version1.22.7
EPSS Score0.04%
EPSS Percentile17th percentile
Description

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

high : CVE--2024--24791

Affected range
>=1.22.0-0
<1.22.5
Fixed version1.22.5
EPSS Score0.04%
EPSS Percentile17th percentile
Description

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail.

An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.

high : CVE--2022--30635

Affected range<1.22.7
Fixed version1.22.7
EPSS Score0.19%
EPSS Percentile57th percentile
Description

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

medium : CVE--2024--24789

Affected range
>=1.22.0-0
<1.22.4
Fixed version1.22.4
EPSS Score0.04%
EPSS Percentile11th percentile
Description

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects files containing these errors.

unspecified : CVE--2024--34155

Affected range<1.22.7
Fixed version1.22.7
EPSS Score0.04%
EPSS Percentile17th percentile
Description

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

unspecified : CVE--2024--24788

Affected range
>=1.22.0-0
<1.22.3
Fixed version1.22.3
EPSS Score0.04%
EPSS Percentile11th percentile
Description

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

critical: 1 high: 1 medium: 1 low: 0 unspecified: 3openssl 3.1.4-r5 (apk)

pkg:apk/alpine/openssl@3.1.4-r5?os_name=alpine&os_version=3.19

# Dockerfile (4:31)
FROM alpine:3.19.1 as deps

ARG GO_APP
ARG GORELEASER_DIST_DIR=/go/src/dist

ARG TARGETOS
ARG TARGETARCH
ARG TARGETVARIANT

RUN mkdir -p /go/bin /go/src ${GORELEASER_DIST_DIR}

COPY --from=build ${GORELEASER_DIST_DIR}/ ${GORELEASER_DIST_DIR}

RUN <<EOT
  set -e 
  apk add --no-cache ca-certificates jq
  cd ${GORELEASER_DIST_DIR}/..

  if [[ ${TARGETARCH} == "arm" ]]; then VARIANT=$(echo ${TARGETVARIANT} | sed 's/^v//'); fi
  BIN_PATH=$(jq -r ".[] |select(.type   == \"Binary\" and \
                                .name   == \"${GO_APP}\" and \
                                .goos   == \"${TARGETOS}\" and \
                                .goarch == \"${TARGETARCH}\" and \
                                (.goarm == \"${VARIANT}\" or .goarm == null)) | .path" < /go/src/dist/artifacts.json)
  cp ${BIN_PATH} /go/bin
EOT

FROM alpine:3.19.1

critical : CVE--2024--5535

Affected range<3.1.6-r0
Fixed version3.1.6-r0
EPSS Score0.04%
EPSS Percentile14th percentile
Description

high : CVE--2024--6119

Affected range<3.1.7-r0
Fixed version3.1.7-r0
EPSS Score0.04%
EPSS Percentile17th percentile
Description

medium : CVE--2024--4603

Affected range<3.1.5-r0
Fixed version3.1.5-r0
EPSS Score0.04%
EPSS Percentile17th percentile
Description

unspecified : CVE--2024--9143

Affected range<3.1.7-r1
Fixed version3.1.7-r1
EPSS Score0.04%
EPSS Percentile11th percentile
Description

unspecified : CVE--2024--4741

Affected range<3.1.6-r0
Fixed version3.1.6-r0
Description

unspecified : CVE--2024--2511

Affected range<3.1.4-r6
Fixed version3.1.4-r6
EPSS Score0.04%
EPSS Percentile17th percentile
Description
critical: 0 high: 0 medium: 4 low: 0 busybox 1.36.1-r15 (apk)

pkg:apk/alpine/busybox@1.36.1-r15?os_name=alpine&os_version=3.19

# Dockerfile (4:31)
FROM alpine:3.19.1 as deps

ARG GO_APP
ARG GORELEASER_DIST_DIR=/go/src/dist

ARG TARGETOS
ARG TARGETARCH
ARG TARGETVARIANT

RUN mkdir -p /go/bin /go/src ${GORELEASER_DIST_DIR}

COPY --from=build ${GORELEASER_DIST_DIR}/ ${GORELEASER_DIST_DIR}

RUN <<EOT
  set -e 
  apk add --no-cache ca-certificates jq
  cd ${GORELEASER_DIST_DIR}/..

  if [[ ${TARGETARCH} == "arm" ]]; then VARIANT=$(echo ${TARGETVARIANT} | sed 's/^v//'); fi
  BIN_PATH=$(jq -r ".[] |select(.type   == \"Binary\" and \
                                .name   == \"${GO_APP}\" and \
                                .goos   == \"${TARGETOS}\" and \
                                .goarch == \"${TARGETARCH}\" and \
                                (.goarm == \"${VARIANT}\" or .goarm == null)) | .path" < /go/src/dist/artifacts.json)
  cp ${BIN_PATH} /go/bin
EOT

FROM alpine:3.19.1

medium : CVE--2023--42366

Affected range<1.36.1-r16
Fixed version1.36.1-r16
EPSS Score0.04%
EPSS Percentile14th percentile
Description

medium : CVE--2023--42365

Affected range<1.36.1-r19
Fixed version1.36.1-r19
EPSS Score0.04%
EPSS Percentile14th percentile
Description

medium : CVE--2023--42364

Affected range<1.36.1-r19
Fixed version1.36.1-r19
EPSS Score0.04%
EPSS Percentile14th percentile
Description

medium : CVE--2023--42363

Affected range<1.36.1-r17
Fixed version1.36.1-r17
EPSS Score0.04%
EPSS Percentile14th percentile
Description