Skip to content
OpenAdvisories

Package · Wolfi

k3d-tools

117 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

49 results · Clear filters · Feed

  • Medium 6.5
    CVE-2021-38698

    HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.

    HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.

    k3d k3d-proxy k3d-tools consul Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2021-38554

    Improper Removal of Sensitive Information Before Storage or Transfer in HashiCorp Vault

    HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

    k3d k3d-proxy k3d-tools github.com/hashicorp/vault Alpine Wolfi Go
  • Medium 5.9
    CVE-2021-31525

    golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion

    net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.

    go stdlib k3d golang-1.16 Debian Ubuntu Alpine Wolfi Go
  • Medium 6.1
    CVE-2020-25864 Scanner template

    HashiCorp Consul Cross-site Scripting vulnerability

    HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.

    k3d k3d-proxy k3d-tools consul Debian Ubuntu Alpine Wolfi Go
  • Medium 5.6
    CVE-2020-8911

    CBC padding oracle in AWS S3 Crypto SDK for GoLang

    A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the…

    Google AWS S3 Crypto SDK for GoLang zot kots Wolfi Go
  • Medium 6.5
    CVE-2019-11254

    Kubernetes API Server denial of service vulnerability from malicious YAML payloads

    The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.

    Kubernetes Kubernetes k3d k3d-proxy Debian Azure Linux Wolfi Go
  • Medium 5.9
    CVE-2019-11841

    Golang/x/crypto message forgery vulnerability

    A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or m…

    k3d k3d-proxy k3d-tools golang.org/x/crypto Debian Ubuntu Wolfi Go
  • Medium 5.9
    CVE-2019-11840

    golang.org/x/crypto/salsa20/salsa uses insufficiently random values

    An issue was discovered in the supplementary Go cryptography library, golang.org/x/crypto, before v0.0.0-20190320223903-b7391e95e576. A flaw was found in the amd64 implementation of the golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa package…

    k3d k3d-proxy k3d-tools snapd Debian Ubuntu Wolfi Go
  • Medium 5.9
    CVE-2018-19653

    HashiCorp Consul can use cleartext agent-to-agent RPC communication

    HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.

    k3d k3d-proxy k3d-tools consul Debian Ubuntu Wolfi Go