Skip to main content
New to Testkube? Unleash the power of cloud native testing in Kubernetes with Testkube. Get Started >

testkube-api-server-2.1.88_linux_arm64

digestsha256:1f831d161e7063d161b8d428b3e4cd681f325e07b03934424239c6f6f2634b0c
vulnerabilitiescritical: 0 high: 0 medium: 5 low: 0 unspecified: 1
platformlinux/arm64
size56 MB
packages209
critical: 0 high: 0 medium: 2 low: 0 unspecified: 1openssl 3.3.2-r0 (apk)

pkg:apk/alpine/openssl@3.3.2-r0?os_name=alpine&os_version=3.20
medium : CVE--2024--9143

Affected range<3.3.2-r1
Fixed version3.3.2-r1
EPSS Score0.044%
EPSS Percentile12th percentile
Description

medium : CVE--2024--13176

Affected range<3.3.2-r2
Fixed version3.3.2-r2
EPSS Score0.044%
EPSS Percentile15th percentile
Description

unspecified : CVE--2024--12797

Affected range<3.3.3-r0
Fixed version3.3.3-r0
Description
critical: 0 high: 0 medium: 1 low: 0 stdlib 1.23.5 (golang)

pkg:golang/stdlib@1.23.5
medium : CVE--2025--22866

Affected range
>=1.23.0-0
<1.23.6
Fixed version1.23.6
EPSS Score0.045%
EPSS Percentile18th percentile
Description

Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.

critical: 0 high: 0 medium: 1 low: 0 github.com/vektah/gqlparser/v2 2.5.2-0.20230422221642-25e09f9d292d (golang)

pkg:golang/github.com/vektah/gqlparser@2.5.2-0.20230422221642-25e09f9d292d#v2
medium 5.3: CVE--2023--49559 Uncontrolled Resource Consumption

Affected range<2.5.14
Fixed version2.5.14
CVSS Score5.3
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score0.043%
EPSS Percentile11th percentile
Description

An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function.

critical: 0 high: 0 medium: 1 low: 0 gopkg.in/square/go-jose.v2 2.6.0 (golang)

pkg:golang/gopkg.in/square/go-jose.v2@2.6.0
medium 4.3: CVE--2024--28180 Improper Handling of Highly Compressed Data (Data Amplification)

Affected range<=2.6.0
Fixed versionNot Fixed
CVSS Score4.3
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS Score0.046%
EPSS Percentile19th percentile
Description

Impact​

An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). Thanks to Enze Wang@Alioth and Jianjun Chen@Zhongguancun Lab (@zer0yu and @chenjj) for reporting.

Patches​

The problem is fixed in the following packages and versions:

  • github.com/go-jose/go-jose/v4 version 4.0.1
  • github.com/go-jose/go-jose/v3 version 3.0.3
  • gopkg.in/go-jose/go-jose.v2 version 2.6.3

The problem will not be fixed in the following package because the package is archived:

  • gopkg.in/square/go-jose.v2