Skip to content
OpenAdvisories
Critical · 9.1 Public exploit CVE-2024-45337 EUVD-2024-3508GHSA-v778-237x-gjrcGO-2024-3321

Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

Published Dec 11, 2024 · Updated Feb 18, 2025 · Assigned by Go

Vendor: golang.org/x/crypto Product: golang.org/x/crypto/ssh Package: aactl Package: actions-runner-controller Package: actions-runner-controller-compat Package: age Package: amass Package: amazon-cloudwatch-agent Package: amazon-cloudwatch-agent-all Package: amazon-cloudwatch-agent-amazon-cloudwatch-agent-config-wizard Package: amazon-cloudwatch-agent-compat Package: amazon-cloudwatch-agent-config-downloader Package: amazon-cloudwatch-agent-config-translator Package: amazon-cloudwatch-agent-operator Package: amazon-cloudwatch-agent-operator-compat Package: amazon-cloudwatch-agent-start-amazon-cloudwatch-agent Package: apko Package: argo-events Package: argo-rollouts Package: argo-workflows Package: atlantis Package: authservice Package: authservice-compat Package: azcopy Package: bank-vaults Package: bank-vaults-template Package: bom Package: boring-registry Package: buf Package: buildah Package: buildctl Package: buildkitd Package: caddy Package: caddy-man Package: caddy-src Package: cadvisor Package: cadvisor-compat Package: cert-exporter Package: cert-manager Package: cert-manager-cmctl Package: cert-manager-istio-csr Package: cert-manager-istio-csr-compat Package: cert-manager-webhook-pdns Package: certificate-transparency Package: certificate-transparency-trillian-ctserver Package: cf-cli Package: cfssl Package: cfssl-bundle Package: cfssl-certinfo Package: cfssl-json Package: cfssl-mkbundle Package: cfssl-multirootca Package: cfssl-newkey Package: cfssl-scan Package: chartmuseum Package: chezmoi Package: cilium-cli Package: cloud-provider-aws-1.31 Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-aws-1.31-ecr-credential-provider Package: cloudflared Package: cloudnative-pg Package: cloudnative-pg-plugins Package: cloudprober Package: cloudprober-compat Package: conftest Package: containerd-1 Package: containerd-2 Package: containerd-service-1 Package: containerd-service-2 Package: containerd-shim-runc-v2-1 Package: containerd-shim-runc-v2-2 Package: containerd-stress-1 Package: containerd-stress-2 Package: cortex Package: cosign Package: cri-o Package: croc Package: crossplane-crank Package: crossplane-provider-aws Package: crossplane-provider-aws-cloudformation Package: crossplane-provider-aws-cloudformation-compat Package: crossplane-provider-aws-cloudfront Package: crossplane-provider-aws-cloudfront-compat Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-cloudwatchlogs-compat Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-dynamodb-compat Package: crossplane-provider-aws-ec2 Package: crossplane-provider-aws-ec2-compat Package: crossplane-provider-aws-eks Package: crossplane-provider-aws-eks-compat Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-elasticache-compat Package: crossplane-provider-aws-firehose Package: crossplane-provider-aws-firehose-compat Package: crossplane-provider-aws-iam Package: crossplane-provider-aws-iam-compat Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-kinesis-compat Package: crossplane-provider-aws-kms Package: crossplane-provider-aws-kms-compat Package: crossplane-provider-aws-lambda Package: crossplane-provider-aws-lambda-compat Package: crossplane-provider-aws-memorydb Package: crossplane-provider-aws-memorydb-compat Package: crossplane-provider-aws-rds Package: crossplane-provider-aws-rds-compat Package: crossplane-provider-aws-route53 Package: crossplane-provider-aws-route53-compat Package: crossplane-provider-aws-s3 Package: crossplane-provider-aws-s3-compat Package: crossplane-provider-aws-sns Package: crossplane-provider-aws-sns-compat Package: crossplane-provider-aws-sqs Package: crossplane-provider-aws-sqs-compat Package: crossplane-provider-azure-authorization Package: crossplane-provider-azure-authorization-compat Package: crossplane-provider-azure-managedidentity Package: crossplane-provider-azure-managedidentity-compat Package: crossplane-provider-azure-sql Package: crossplane-provider-azure-sql-compat Package: crossplane-provider-azure-storage Package: crossplane-provider-azure-storage-compat Package: crossplane-provider-family-aws Package: crossplane-provider-family-aws-compat Package: crossplane-provider-family-azure Package: crossplane-provider-family-azure-compat Package: crossplane-provider-keycloak Package: crossplane-provider-sql Package: ctr-1 Package: ctr-2 Package: dagdotdev Package: dagger Package: dbmate Package: descheduler Package: dex Package: dex-iamguarded-compat Package: dgraph Package: distribution Package: docker-buildx Package: docker-cli-buildx Package: docker-compose Package: docker-compose Package: docker-credential-acr-env Package: docker-dind Package: dockerize Package: doppler-kubernetes-operator Package: dynamic-localpv-provisioner Package: eksctl Package: envoy-gateway Package: envoy-gateway-compat Package: envoy-gateway-egctl Package: extism Package: falcoctl Package: falcosidekick Package: ferretdb Package: filebrowser Package: filebrowser-compat Package: flannel Package: flannel-compat Package: fluent-bit-plugin-loki Package: flux Package: flux-helm-controller Package: flux-helm-controller-iamguarded-compat Package: flux-image-automation-controller Package: flux-image-automation-controller-compat Package: flux-image-automation-controller-iamguarded-compat Package: flux-image-reflector-controller Package: flux-image-reflector-controller-iamguarded-compat Package: flux-kustomize-controller Package: flux-kustomize-controller-iamguarded-compat Package: flux-notification-controller Package: flux-notification-controller-iamguarded-compat Package: flux-source-controller Package: flux-source-controller-iamguarded-compat Package: flyte Package: fq Package: frp Package: fscrypt Package: fulcio Package: gcsfuse Package: gh Package: gh Package: gh-doc Package: git-lfs Package: git-lfs-config Package: gitea Package: gitleaks Package: gitness Package: gitsign Package: gitsign-config Package: gitsign-credential-cache Package: glab Package: go-discover Package: go-licenses Package: gobuster Package: golang-go.crypto Package: golang-go.crypto Package: golang.org/x/crypto Package: gomplate Package: google-guest-agent Package: goreleaser Package: gostatsd Package: gptscript Package: grafana-agent-operator Package: grafana-alloy Package: grafana-mimir Package: grpc-health-probe Package: grpc-health-probe-compat Package: grype Package: guac Package: guaccsub Package: guacgql Package: guacingest Package: guacone Package: harbor-registry Package: hcloud Package: helm Package: helm-3 Package: helm-4 Package: helm-docs Package: helm-operator Package: helm-operator-compat Package: helm-push Package: hugo Package: hugo-extended Package: jitsucom-bulker Package: jitsucom-bulker-bulker Package: jitsucom-bulker-bulker-compat Package: jitsucom-bulker-ingest Package: jitsucom-bulker-ingest-compat Package: jitsucom-bulker-ingmgr Package: jitsucom-bulker-ingmgr-compat Package: jitsucom-bulker-sidecar Package: jitsucom-bulker-sidecar-compat Package: jitsucom-bulker-syncctl Package: jitsucom-bulker-syncctl-compat Package: k3d Package: k3d-proxy Package: k3d-tools Package: k3s Package: k3s-1.32 Package: k3s-multicall Package: k3s-static Package: k3s-static-1.32 Package: k6 Package: k8sgpt Package: k8ssandra-client Package: k8ssandra-client-compat Package: k9s Package: kaf Package: kafka_exporter Package: kafka-proxy Package: kafka-proxy-compat Package: kaniko Package: kaniko-compat Package: kaniko-warmer Package: kaniko-warmer-compat Package: kapp-controller Package: kapp-controller-compat Package: kargo Package: kargo-oci-compat Package: katib-controller Package: katib-controller-compat Package: katib-db-manager Package: katib-db-manager-compat Package: katib-earlystopping Package: katib-file-metricscollector Package: katib-file-metricscollector-compat Package: katib-suggestion-goptuna Package: katib-suggestion-goptuna-compat Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-nas-enas Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: katib-tfevent-metricscollector Package: kiali Package: kine Package: ko Package: kots Package: kots-compat Package: kots-symlink-compat Package: kserve Package: kserve-agent Package: kserve-agent-compat Package: kserve-manager Package: kserve-manager-compat Package: kserve-modelmesh-serving Package: kserve-modelmesh-serving-compat Package: kserve-qpext Package: kserve-qpext-compat Package: kserve-router Package: kserve-router-compat Package: kserve-storage-controller Package: ksops Package: ksops-compat Package: kube-bench Package: kube-bench-configs Package: kube-fluentd-operator Package: kube-fluentd-operator-compat Package: kube-fluentd-operator-default-config Package: kube-fluentd-operator-oci-entrypoint Package: kube-metrics-adapter Package: kube-rbac-proxy Package: kube-state-metrics Package: kube-state-metrics-iamguarded-compat Package: kube-vip Package: kube-vip-compat Package: kubectl-1.27 Package: kubectl-1.27-default Package: kubectl-1.28 Package: kubectl-1.28-default Package: kubectl-1.29 Package: kubectl-1.29-default Package: kubectl-1.30 Package: kubectl-1.30-default Package: kubectl-1.31 Package: kubectl-1.31-default Package: kubectl-1.32 Package: kubectl-1.32-default Package: kubectl-argo-rollouts Package: kubectl-bash-completion-1.27 Package: kubectl-bash-completion-1.28 Package: kubectl-bash-completion-1.29 Package: kubectl-bash-completion-1.30 Package: kubeflow Package: kubeflow-access-management Package: kubeflow-access-management-compat Package: kubeflow-admission-webhook Package: kubeflow-admission-webhook-compat Package: kubeflow-katib Package: kubeflow-notebook-controller Package: kubeflow-notebook-controller-compat Package: kubeflow-pipelines Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-cache-deployer Package: kubeflow-pipelines-cache-deployer-compat Package: kubeflow-pipelines-frontend Package: kubeflow-pipelines-metadata-envoy-config Package: kubeflow-pipelines-metadata-writer Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: kubeflow-profile-controller Package: kubeflow-profile-controller-compat Package: kubeflow-pvcviewer-controller Package: kubeflow-pvcviewer-controller-compat Package: kubeflow-tensorboard-controller Package: kubeflow-tensorboard-controller-compat Package: kubernetes-dashboard Package: kubernetes-dashboard-api Package: kubernetes-dashboard-api-compat Package: kubernetes-dashboard-auth Package: kubernetes-dashboard-auth-compat Package: kubernetes-dashboard-web Package: kubernetes-dashboard-web-compat Package: kubernetes-dns-node-cache Package: kubernetes-event-exporter Package: kubernetes-event-exporter-iamguarded-compat Package: kubescape Package: kubevela Package: kubevela-vela-cli Package: kubevela-vela-core Package: kubevela-vela-core-compat Package: kubevirt Package: kubewatch Package: kwok Package: kwokctl Package: kyverno-notation-aws Package: kyverno-notation-aws-compat Package: kyverno-policy-reporter Package: kyverno-policy-reporter-compat Package: lazygit Package: linkerd2 Package: linkerd2-cli Package: linkerd2-controller Package: linkerd2-controller-compat Package: linkerd2-debug Package: linkerd2-metrics-api Package: linkerd2-metrics-api-compat Package: linkerd2-proxy-identity Package: linkerd2-tap Package: linkerd2-tap-compat Package: linkerd2-web Package: litestream Package: local-path-provisioner Package: local-static-provisioner Package: local-static-provisioner-compat Package: local-volume-node-cleanup Package: local-volume-node-cleanup-compat Package: lxd Package: mailpit Package: mailpit-compat Package: mc Package: mc-iamguarded-2025-compat Package: memcached-exporter Package: memcached-exporter-iamguarded-compat Package: metrics-server Package: metrics-server-compat Package: metrics-server-iamguarded-compat Package: minio Package: minio-iamguarded-2025-compat Package: minio-operator Package: minio-operator-compat Package: minio-operator-sidecar Package: minio-operator-sidecar-compat Package: mkcert Package: moby-compose Package: moby-engine Package: mongo-tools Package: nats Package: nats-server Package: nats-server-compat Package: nerdctl Package: neuvector-sigstore-interface Package: newrelic-nri-statsd Package: nfs-subdir-external-provisioner Package: nginx-prometheus-exporter Package: nginx-prometheus-exporter-iamguarded-compat Package: nri-kafka Package: nri-kafka-compat Package: nri-kafka-jdk11 Package: nri-mssql Package: nri-mssql-compat Package: nsc Package: nuclei Package: oauth2-proxy Package: oauth2-proxy-iamguarded-compat Package: octo-sts Package: octo-sts-webhook Package: ollama Package: ollama-cpu Package: openbao Package: openbao-compat Package: openbao-k8s Package: openbao-k8s-compat Package: opentelemetry-collector Package: opentelemetry-collector-compat Package: opentelemetry-collector-contrib Package: opentelemetry-collector-contrib-compat Package: opentelemetry-collector-ocb Package: oras Package: osv-scanner Package: packer Package: podman Package: podman Package: podman-doc Package: policy-controller Package: policy-controller-tester Package: portieris Package: portieris-compat Package: postgres-operator Package: postgres-operator-compat Package: prometheus-adapter Package: prometheus-admission-webhook Package: prometheus-alertmanager Package: prometheus-alertmanager-iamguarded-compat Package: prometheus-config-reloader Package: prometheus-operator Package: prometheus-operator-iamguarded-compat Package: prometheus-pushgateway Package: prometheus-pushgateway-iamguarded-compat Package: promxy Package: pulumi Package: pulumi-kubernetes-operator Package: pulumi-language-dotnet Package: pulumi-language-java Package: pulumi-language-yaml Package: q Package: rabbitmq-messaging-topology-operator Package: rabbitmq-messaging-topology-operator-compat Package: rabbitmq-messaging-topology-operator-iamguarded-compat Package: rancher-fleet Package: rancher-fleet-agent Package: rancher-fleet-cli Package: rancher-fleet-controller Package: rancher-fleet-termination-log Package: rclone Package: rclone Package: rclone-compat Package: rekor Package: rekor-backfill-index Package: rekor-cli Package: rekor-server Package: restic Package: restic-compat Package: rook Package: rook-oci-compat Package: rqlite Package: rqlite-oci-entrypoint Package: sbomqs Package: scorecard Package: seaweedfs Package: seaweedfs-iamguarded-compat Package: seaweedfs-oci-entrypoint Package: secrets-store-csi-driver Package: secrets-store-csi-driver-crds Package: secrets-store-csi-driver-provider-azure Package: secrets-store-csi-driver-provider-gcp Package: sftpgo-plugin-auth Package: sftpgo-plugin-eventsearch Package: sftpgo-plugin-eventstore Package: sftpgo-plugin-kms Package: sftpgo-plugin-pubsub Package: sigstore-scaffolding Package: sigstore-scaffolding-cloudsqlproxy Package: sigstore-scaffolding-ctlog-createctconfig Package: sigstore-scaffolding-ctlog-managectroots Package: sigstore-scaffolding-ctlog-verifyfulcio Package: sigstore-scaffolding-fulcio-createcerts Package: sigstore-scaffolding-getoidctoken Package: sigstore-scaffolding-rekor-createsecret Package: sigstore-scaffolding-trillian-createdb Package: sigstore-scaffolding-trillian-createtree Package: sigstore-scaffolding-trillian-updatetree Package: sigstore-scaffolding-tsa-createcertchain Package: sigstore-scaffolding-tuf-createsecret Package: sigstore-scaffolding-tuf-server Package: skaffold Package: skopeo Package: slsa-verifier Package: snyk-cli Package: sops Package: spark-operator Package: spark-operator-oci-entrypoint Package: spegel Package: spegel-compat Package: spicedb Package: spiffe-helper Package: spiffe-helper-compat Package: spire-agent Package: spire-oidc-discovery-provider Package: spire-server Package: splunk-otel-collector Package: splunk-otel-collector-compat Package: splunk-otel-collector-doc Package: spqr Package: sql_exporter Package: src Package: src-fingerprint Package: step Package: step-ca Package: step-issuer Package: step-issuer-compat Package: swagger Package: syft Package: tailscale Package: tailscale-compat Package: task Package: tdbg Package: tdbg-compat Package: tekton-chains Package: telegraf Package: temporal Package: temporal-cassandra-tool Package: temporal-cassandra-tool-compat Package: temporal-compat Package: temporal-server Package: temporal-server-compat Package: temporal-server-oci-entrypoint Package: temporal-server-schema Package: temporal-sql-tool Package: temporal-sql-tool-compat Package: temporal-ui-server Package: temporal-ui-server-oci-entrypoint Package: terraform Package: terraform-compat Package: terraform-docs Package: terraform-local-provider-config Package: terraform-provider-aws Package: terraform-provider-azurerm Package: terraform-provider-google Package: terraform-provider-sendgrid Package: terraform-provider-tls Package: terragrunt Package: terragrunt-docs Package: tflint Package: tflint-compat Package: tfsec Package: thanos Package: thanos-iamguarded-compat Package: timestamp-authority Package: timestamp-authority-cli Package: timestamp-authority-server Package: tkn Package: trillian Package: trillian-logserver Package: trillian-logsigner Package: trivy Package: trust-manager Package: undock Package: up Package: vault-benchmark Package: vault-benchmark-compat Package: vault-k8s Package: vcluster Package: vcluster-cli Package: vcluster-syncer Package: velero Package: velero-compat Package: velero-plugin-for-microsoft-azure Package: velero-plugin-for-microsoft-azure-compat Package: velero-restore-helper Package: vendir Package: vexctl Package: weaviate Package: wgcf Package: wireguard-go Package: wolfictl Package: x509-certificate-exporter Package: x509-certificate-exporter-compat Package: zarf Package: zot Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Affected products

VendorProductAffectedFixed
golang.org/x/crypto golang.org/x/crypto/ssh < 0.31.0 0.31.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-go.crypto 1:0.42.0-1 —
Debian 13 golang-go.crypto No fix yet —
Debian 12 golang-go.crypto No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 golang-go.crypto No fix yet —
Ubuntu 24.04 LTS google-guest-agent 20250116.00-0ubuntu1~24.04.2 USN-7839-2
Ubuntu 22.04 LTS google-guest-agent 20250116.00-0ubuntu1~22.04.1 USN-7839-2
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS golang-go.crypto 1:0.19.0-1ubuntu0.1~esm1 USN-7839-1
Ubuntu Pro 22.04 LTS golang-go.crypto 1:0.0~git20211202.5770296-1ubuntu0.1~esm1 USN-7839-1
Ubuntu Pro 20.04 LTS golang-go.crypto 1:0.0~git20200221.2aa609c-1ubuntu0.1~esm1 USN-7839-1
Ubuntu Pro 20.04 LTS google-guest-agent 20250116.00-0ubuntu1~20.04.0+esm1 USN-7839-2
Ubuntu Pro 18.04 LTS golang-go.crypto 1:0.0~git20170629.0.5ef0053-2ubuntu0.1~esm1 USN-7839-1
Ubuntu Pro 18.04 LTS google-guest-agent 20241011.01-0ubuntu1~18.04.0+esm1 USN-7839-2
Ubuntu Pro 18.04 LTS lxd No fix yet —
Ubuntu Pro 16.04 LTS golang-go.crypto 1:0.0~git20151201.0.7b85b09-2ubuntu0.1~esm1 USN-7839-1
Ubuntu Pro 16.04 LTS google-guest-agent 20240716.00-0ubuntu1~16.04.0+esm1 USN-7839-2
Ubuntu Pro 16.04 LTS lxd No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Openshift Service On Aws 1 rosa +1 1.2.53-5be4e19.el8 RHEA-2025:4438

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 google-guest-agent 20260529.00-150000.1.70.1 SUSE-SU-2026:2612-1
SLES 15 SP7 kubevirt 1.5.2-150700.3.5.2 SUSE-SU-2025:02581-1
SLES 15 SP6 apptainer 1.3.6-150600.4.9.1 SUSE-SU-2025:0980-1
SLES 15 SP6 brise 20230603+git.5fdd2d6-150600.3.8.1 SUSE-SU-2025:0601-1
SLES 15 SP6 golang-github-prometheus-promu 0.17.0-150000.3.24.1 SUSE-SU-2025:0525-1
SLES 15 SP6 google-guest-agent 20250327.01-150000.1.60.1 SUSE-SU-2026:2612-1, SUSE-SU-2025:1143-1
SLES 15 SP6 govulncheck-vulndb 0.0.20250226T025151-150000.1.35.1 SUSE-SU-2025:0770-1
SLES 15 SP6 grafana 10.4.13-150200.3.59.1 SUSE-SU-2025:0545-1
SLES 15 SP6 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLES 15 SP6 kubevirt 1.4.1-150600.5.24.1 SUSE-SU-2025:03278-1
SLES 15 SP6 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SLES 15 SP5 google-guest-agent 20250327.01-150000.1.60.1 SUSE-SU-2026:2612-1, SUSE-SU-2025:1143-1
SLES 15 SP5 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLES 15 SP5 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SLES 15 SP4 google-guest-agent 20250327.01-150000.1.60.1 SUSE-SU-2026:2612-1, SUSE-SU-2025:1143-1
SLES 15 SP4 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLES 15 SP4 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SLES 15 SP3 google-guest-agent 20250327.01-150000.1.60.1 SUSE-SU-2025:1143-1
SLES 15 SP3 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLES 15 SP3 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
Show 17 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 google-guest-agent 20250327.01-1.50.1 SUSE-SU-2026:2581-1, SUSE-SU-2025:1142-1
SLES for SAP 15 SP5 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLES for SAP 15 SP5 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SLES for SAP 15 SP4 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLES for SAP 15 SP4 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SLES for SAP 15 SP3 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLES for SAP 15 SP3 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SLE Micro 6.1 helm 3.17.2-slfo.1.1_1.1 SUSE-SU-2025:20278-1
SLE Micro 6.0 helm 3.17.2-1.1 SUSE-SU-2025:20196-1
SLE Micro 5.5 google-guest-agent 20250327.01-150000.1.60.1 SUSE-SU-2026:2612-1, SUSE-SU-2025:1143-1
SLE Micro 5.5 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLE HPC 15 SP5 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLE HPC 15 SP5 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SLE HPC 15 SP4 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLE HPC 15 SP4 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SLE HPC 15 SP3 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SLE HPC 15 SP3 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SUSE Package Hub 15 SP6 cheat 4.4.2-bp156.3.3.1 openSUSE-SU-2025:0025-1
SUSE Package Hub 15 SP6 gitea-tea 0.9.2-bp156.5.1 openSUSE-SU-2025:0094-1
SUSE Package Hub 15 SP6 trivy 0.58.2-bp156.2.6.1 openSUSE-SU-2025:0056-1
SUSE Manager Server 4.3 release-notes-susemanager 4.3.15.2-150400.3.133.1 SUSE-SU-2025:01985-1
SUSE Manager Server 4.3 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SUSE Manager Proxy 4.3 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools for SLE Micro 5 dracut-saltboot 0.1.1728559936.c16d4fb-150000.1.56.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools for SLE Micro 5 uyuni-tools 0.1.28-150000.1.16.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools 15 dracut-saltboot 0.1.1728559936.c16d4fb-150000.1.56.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools 15 golang-github-prometheus-prometheus 2.53.3-150000.3.59.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools 15 grafana 10.4.13-150000.1.66.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools 15 spacecmd 5.0.11-150000.3.130.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools 15 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools 15 supportutils-plugin-susemanager-client 5.0.4-150000.3.27.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools 15 uyuni-tools 0.1.28-150000.1.16.1 SUSE-SU-2025:0525-1
SUSE Manager Client Tools 12 golang-github-prometheus-prometheus 2.53.3-1.56.1 SUSE-SU-2025:0524-1
SUSE Manager Client Tools 12 golang-github-prometheus-promu 0.17.0-1.24.1 SUSE-SU-2025:0524-1
SUSE Manager Client Tools 12 grafana 10.4.13-1.66.2 SUSE-SU-2025:0524-1
SUSE Manager Client Tools 12 spacecmd 5.0.11-38.153.1 SUSE-SU-2025:0524-1
SUSE Manager Client Tools 12 supportutils-plugin-salt 1.2.3-6.25.1 SUSE-SU-2025:0524-1
SUSE Manager Client Tools 12 supportutils-plugin-susemanager-client 5.0.4-6.33.1 SUSE-SU-2025:0524-1
SUSE Manager Client Tools 12 uyuni-tools 0.1.28-1.16.1 SUSE-SU-2025:0524-1
SUSE Enterprise Storage 7.1 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
SUSE Enterprise Storage 7.1 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed apptainer 1.3.6-5.1 openSUSE-SU-2025:14909-1
openSUSE Tumbleweed cloudflared 2024.12.1-1.1 openSUSE-SU-2024:14585-1
openSUSE Tumbleweed git-bug 0.8.0+git.1733745604.d499b6e-1.1 openSUSE-SU-2024:14592-1
openSUSE Tumbleweed gitleaks 8.24.2-1.1 openSUSE-SU-2025:14920-1
openSUSE Tumbleweed golang-github-prometheus-prometheus 3.1.0-1.1 openSUSE-SU-2025:14660-1
openSUSE Tumbleweed google-guest-agent 20250327.01-1.1 openSUSE-SU-2025:14969-1
openSUSE Tumbleweed gopass 1.15.16-1.1 openSUSE-SU-2025:15013-1
openSUSE Tumbleweed govulncheck-vulndb 0.0.20241213T205935-1.1 openSUSE-SU-2024:14599-1
openSUSE Tumbleweed grafana 11.3.0-4.1 openSUSE-SU-2025:14633-1
openSUSE Tumbleweed helm 3.16.4-1.1 openSUSE-SU-2024:14593-1
openSUSE Tumbleweed helm3 3.19.2-1.1 openSUSE-SU-2025:15779-1
openSUSE Tumbleweed k3sup 0.13.14-1.1 openSUSE-SU-2026:12295-1
openSUSE Tumbleweed kubeseal 0.41.1-1.1 openSUSE-SU-2026:12299-1
openSUSE Tumbleweed kumactl 3.0.0-1.1 openSUSE-SU-2026:12300-1
openSUSE Tumbleweed loki 3.3.2-1.1 openSUSE-SU-2024:14604-1
openSUSE Tumbleweed minikube 1.36.0-2.1 openSUSE-SU-2025:15463-1
openSUSE Tumbleweed rclone 1.69.0-1.1 openSUSE-SU-2025:14641-1
openSUSE Tumbleweed rime-plum-go 1.0.3-1.1 openSUSE-SU-2025:14902-1
openSUSE Tumbleweed tailscale 1.78.3-2.1 openSUSE-SU-2024:14602-1
openSUSE Tumbleweed teleport 17.0.5-1.1 openSUSE-SU-2024:14573-1
openSUSE Tumbleweed traefik 3.2.3-1.1 openSUSE-SU-2024:14590-1
openSUSE Tumbleweed traefik2 2.11.16-1.1 openSUSE-SU-2024:14595-1
openSUSE Tumbleweed trivy 0.58.2-1.1 openSUSE-SU-2025:14713-1
openSUSE Tumbleweed velero 1.15.1-1.1 openSUSE-SU-2025:14613-1
openSUSE Tumbleweed vexctl 0.4.1+git78.f951e3a-1.1 openSUSE-SU-2026:10230-1
openSUSE Leap 16.0 git-bug 0.10.1-bp160.1.1 openSUSE-SU-2025:20143-1
openSUSE Leap 16.0 gitea-tea 0.15.1-bp160.1.1 openSUSE-SU-2026:21603-1
openSUSE Leap 16.0 google-guest-agent 20250506.01-160000.1.1 openSUSE-SU-2026:20609-1
openSUSE Leap 16.0 vexctl 0.4.4+git20.5d61136-160000.1.1 openSUSE-SU-2026:21481-1
openSUSE Leap 15.6 apptainer 1.3.6-150600.4.9.1 SUSE-SU-2025:0980-1
openSUSE Leap 15.6 brise 20230603+git.5fdd2d6-150600.3.8.1 SUSE-SU-2025:0601-1
openSUSE Leap 15.6 cheat 4.4.2-bp156.3.3.1 openSUSE-SU-2025:0025-1
openSUSE Leap 15.6 dracut-saltboot 0.1.1728559936.c16d4fb-150000.1.56.1 SUSE-SU-2025:0525-1
openSUSE Leap 15.6 gitea-tea 0.9.2-bp156.5.1 openSUSE-SU-2025:0094-1
openSUSE Leap 15.6 golang-github-prometheus-promu 0.17.0-150000.3.24.1 SUSE-SU-2025:0525-1
openSUSE Leap 15.6 google-guest-agent 20250327.01-150000.1.60.1 SUSE-SU-2025:1143-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20250226T025151-150000.1.35.1 SUSE-SU-2025:0770-1
openSUSE Leap 15.6 grafana 10.4.13-150200.3.59.1 SUSE-SU-2025:0545-1
openSUSE Leap 15.6 helm 3.17.1-150000.1.41.1 SUSE-SU-2025:0602-1
openSUSE Leap 15.6 kubevirt 1.4.1-150600.5.24.1 SUSE-SU-2025:03278-1
openSUSE Leap 15.6 spacecmd 5.0.11-150000.3.130.1 SUSE-SU-2025:0525-1
openSUSE Leap 15.6 supportutils-plugin-salt 1.2.3-150000.3.16.1 SUSE-SU-2025:0525-1
openSUSE Leap 15.6 supportutils-plugin-susemanager-client 5.0.4-150000.3.27.1 SUSE-SU-2025:0525-1
openSUSE Leap 15.6 trivy 0.58.2-bp156.2.6.1 openSUSE-SU-2025:0056-1
openSUSE Leap 15.6 vexctl 0.4.1+git78.f951e3a-150000.1.11.1 SUSE-SU-2026:0592-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 rclone 1.69.0-r0 —
Alpine v3.23 rclone 1.69.0-r0 —
Alpine v3.22 rclone 1.69.0-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 amazon-cloudwatch-agent 1.300052.1-1.amzn2023 ALAS2023-2025-880
Amazon Linux 2023 containerd +1 1.7.25-1.amzn2023.0.1 ALAS2023-2025-835
Amazon Linux 2023 nerdctl 2.0.3-1.amzn2023.0.1 ALAS2023-2025-833
Amazon Linux 2023 runfinch-finch 1.6.0-1.amzn2023.0.1 ALAS2023-2025-834
Amazon Linux 2 amazon-cloudwatch-agent 1.300052.1-1.amzn2 ALAS2-2025-2779
Amazon Linux 2 nerdctl 2.0.3-1.amzn2.0.1 ALAS2-2025-2749

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 cert-manager 1.12.13-2 —
Azure Linux 3 cf-cli 8.7.3-4 —
Azure Linux 3 cri-o No fix yet —
Azure Linux 3 docker-buildx 0.14.0-2 —
Azure Linux 3 docker-compose 2.27.0-2 —
Azure Linux 3 gh 2.62.0-3 —
Azure Linux 3 kubevirt 1.2.0-11 —
Azure Linux 3 moby-engine 25.0.3-9 —
Azure Linux 3 packer 1.9.5-4 —
Azure Linux 3 telegraf 1.31.0-3 —
Azure Linux 2 (CBL-Mariner) cert-manager 1.11.2-16 —
Azure Linux 2 (CBL-Mariner) moby-compose 2.17.3-9 —
Azure Linux 2 (CBL-Mariner) moby-engine 24.0.9-13 —
Azure Linux 2 (CBL-Mariner) packer 1.9.5-5 —
Azure Linux 2 (CBL-Mariner) podman No fix yet —
Azure Linux 2 (CBL-Mariner) telegraf 1.29.4-10 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r20 —
Wolfi rolling actions-runner-controller +1 0.9.3-r4 —
Wolfi rolling age 1.2.0-r3 —
Wolfi rolling amass 4.2.0-r14 —
Wolfi rolling amazon-cloudwatch-agent +6 1.300051.0-r1 —
Wolfi rolling amazon-cloudwatch-agent-operator +1 2.0.0-r1 —
Wolfi rolling apko 0.21.0-r1 —
Wolfi rolling argo-events 1.9.3-r1 —
Wolfi rolling argo-rollouts +1 1.7.2-r2 —
Wolfi rolling argo-workflows 3.6.2-r1 —
Wolfi rolling atlantis +1 0.31.0-r1 —
Wolfi rolling authservice +1 1.0.3-r1 —
Wolfi rolling azcopy 10.27.1-r1 —
Wolfi rolling bank-vaults +1 1.20.4-r21 —
Wolfi rolling bom 0.6.0-r11 —
Wolfi rolling boring-registry 0.15.4-r2 —
Wolfi rolling buf 1.47.2-r2 —
Wolfi rolling buildah +2 1.38.0-r1 —
Wolfi rolling buildctl +1 0.18.1-r2 —
Wolfi rolling caddy +2 2.8.4-r5 —
Wolfi rolling cadvisor +1 0.51.0-r1 —
Wolfi rolling cert-exporter +2 2.14.0-r1 —
Wolfi rolling cert-manager-cmctl 2.1.1-r2 —
Wolfi rolling cert-manager-webhook-pdns 2.5.1-r8 —
Wolfi rolling certificate-transparency +1 1.3.0-r1 —
Wolfi rolling cfssl +7 1.6.5-r11 —
Wolfi rolling chartmuseum 0.16.2-r8 —
Wolfi rolling chezmoi 2.55.0-r1 —
Wolfi rolling cilium-cli 0.16.22-r1 —
Wolfi rolling cloud-provider-aws-1.31 +2 1.31.4-r1 —
Wolfi rolling cloudflared 2024.12.1-r1 —
Wolfi rolling cloudnative-pg +1 1.24.1-r1 —
Wolfi rolling cloudprober +1 0.13.8-r1 —
Wolfi rolling conftest 0.56.0-r1 —
Wolfi rolling cortex +1 1.18.1-r1 —
Wolfi rolling cosign 2.4.1-r2 —
Wolfi rolling croc 10.1.3-r1 —
Wolfi rolling crossplane-provider-sql 0.9.0-r2 —
Wolfi rolling ctr-1 +4 1.7.24-r3 —
Wolfi rolling ctr-2 +4 2.0.0-r2 —
Wolfi rolling dagdotdev 0.0.11-r1 —
Wolfi rolling dagger +2 0.15.0-r1 —
Wolfi rolling dbmate 2.24.0-r1 —
Wolfi rolling dex +1 2.41.1-r2 —
Wolfi rolling dgraph 24.0.5-r1 —
Wolfi rolling distribution 3.0.0-r3 —
Wolfi rolling docker-cli-buildx 0.19.2-r1 —
Wolfi rolling docker-compose 2.32.0-r0 —
Wolfi rolling docker-credential-acr-env 0.7.0-r16 —
Wolfi rolling docker-dind 27.4.0-r1 —
Wolfi rolling doppler-kubernetes-operator 1.5.1-r6 —
Wolfi rolling dynamic-localpv-provisioner 4.1.2-r1 —
Wolfi rolling eksctl 0.198.0-r1 —
Wolfi rolling envoy-gateway +5 1.2.3-r1 —
Wolfi rolling extism 1.6.1-r1 —
Wolfi rolling falcoctl 0.10.1-r1 —
Wolfi rolling falcosidekick 2.30.0-r1 —
Wolfi rolling ferretdb 1.24.0-r2 —
Wolfi rolling filebrowser +1 2.31.2-r1 —
Wolfi rolling flannel +1 0.26.5-r3 —
Wolfi rolling fluent-bit-plugin-loki 3.3.1-r1 —
Wolfi rolling flux 2.4.0-r1 —
Wolfi rolling flux-helm-controller +1 1.1.0-r1 —
Wolfi rolling flux-image-automation-controller +2 0.39.0-r2 —
Wolfi rolling flux-image-reflector-controller +1 0.33.0-r3 —
Wolfi rolling flux-notification-controller +1 1.4.0-r2 —
Wolfi rolling flux-source-controller +1 1.4.1-r3 —
Wolfi rolling flyte 1.14.0-r1 —
Wolfi rolling fq +2 0.13.0-r1 —
Wolfi rolling frp 0.61.0-r2 —
Wolfi rolling fscrypt 0.3.5-r3 —
Wolfi rolling fulcio 1.6.5-r1 —
Wolfi rolling gcsfuse 1.4.2-r12 —
Wolfi rolling gh +1 2.63.2-r1 —
Wolfi rolling git-lfs +1 3.6.0-r3 —
Wolfi rolling gitea 1.22.5-r0 —
Wolfi rolling gitleaks 8.22.0-r1 —
Wolfi rolling gitness 3.0.1-r1 —
Wolfi rolling gitsign +2 0.11.0-r2 —
Wolfi rolling glab 1.50.0-r1 —
Wolfi rolling go-discover 0_git20241212-r1 —
Wolfi rolling go-licenses 1.6.0-r17 —
Wolfi rolling gobuster 3.6.0-r15 —
Wolfi rolling gomplate 4.2.0-r1 —
Wolfi rolling goreleaser 2.4.8-r1 —
Wolfi rolling gostatsd 28.3.0-r7 —
Wolfi rolling gptscript 0.9.5-r1 —
Wolfi rolling grafana-agent-operator 0.43.4-r1 —
Wolfi rolling grafana-alloy 1.5.1-r1 —
Wolfi rolling grafana-mimir 2.14.2-r1 —
Wolfi rolling grpc-health-probe +1 0.4.35-r1 —
Wolfi rolling grype 0.86.0-r1 —
Wolfi rolling guac +4 0.12.0-r2 —
Wolfi rolling harbor-registry 3.0.0_alpha1-r8 —
Wolfi rolling hcloud 1.49.0-r1 —
Wolfi rolling helm 3.16.3-r1 —
Wolfi rolling helm-3 3.19.2-r1 —
Wolfi rolling helm-4 4.0.1-r1 —
Wolfi rolling helm-docs 1.14.2-r3 —
Wolfi rolling helm-push 0.10.4-r16 —
Wolfi rolling hugo 0.139.4-r1 —
Wolfi rolling hugo-extended 0.139.3-r1 —
Wolfi rolling jitsucom-bulker +10 2.8.4-r1 —
Wolfi rolling k3d +2 5.7.5-r1 —
Wolfi rolling k3s +2 1.32.4.1-r1 —
Wolfi rolling k3s-1.32 +1 1.32.13.1-r2 —
Wolfi rolling k6 0.55.0-r1 —
Wolfi rolling k8sgpt 0.3.48-r1 —
Wolfi rolling k8ssandra-client +1 0.6.0-r1 —
Wolfi rolling k9s 0.32.7-r1 —
Wolfi rolling kaf 0.2.8-r7 —
Wolfi rolling kafka-proxy +1 0.3.12-r1 —
Wolfi rolling kafka_exporter 1.8.0-r3 —
Wolfi rolling kaniko +3 1.23.2-r6 —
Wolfi rolling kapp-controller +1 0.54.1-r1 —
Wolfi rolling kargo +1 1.1.1-r1 —
Wolfi rolling kiali 2.2.0-r1 —
Wolfi rolling kine 0.13.6-r1 —
Wolfi rolling ko 0.17.1-r2 —
Wolfi rolling kots +2 1.122.0-r0 —
Wolfi rolling kserve +9 0.14.0-r0 —
Wolfi rolling kserve-modelmesh-serving +1 0.12.0-r3 —
Wolfi rolling ksops +1 4.3.2-r4 —
Wolfi rolling kube-bench +1 0.9.3-r1 —
Wolfi rolling kube-fluentd-operator +3 1.18.2-r19 —
Wolfi rolling kube-metrics-adapter 0.2.3-r3 —
Wolfi rolling kube-rbac-proxy 0.18.2-r1 —
Wolfi rolling kube-vip +1 0.8.7-r1 —
Wolfi rolling kubectl-1.28 +2 1.28.15-r3 —
Wolfi rolling kubectl-1.29 +2 1.29.12-r1 —
Wolfi rolling kubectl-1.30 +2 1.30.8-r1 —
Wolfi rolling kubectl-1.31 +1 1.31.4-r2 —
Wolfi rolling kubectl-1.32 +1 1.32.0-r2 —
Wolfi rolling kubeflow +12 1.10.0-r4 —
Wolfi rolling kubeflow-katib +17 0.17.0-r7 —
Wolfi rolling kubeflow-pipelines +11 2.3.0-r4 —
Wolfi rolling kubernetes-dashboard 7.10.0-r1 —
Wolfi rolling kubernetes-dashboard-api +1 1.10.1-r1 —
Wolfi rolling kubernetes-dashboard-auth +1 1.2.2-r2 —
Wolfi rolling kubernetes-dns-node-cache 1.24.0-r1 —
Wolfi rolling kubernetes-event-exporter +1 1.7-r12 —
Wolfi rolling kubescape 3.0.22-r1 —
Wolfi rolling kubevela +3 1.9.13-r3 —
Wolfi rolling kubewatch 2.9.0-r1 —
Wolfi rolling kwok +1 0.6.1-r1 —
Wolfi rolling kyverno-notation-aws +1 1.0.1_git20241214-r0 —
Wolfi rolling kyverno-policy-reporter +1 2.24.2-r1 —
Wolfi rolling lazygit 0.44.1-r1 —
Wolfi rolling linkerd2 +10 24.11.8-r1 —
Wolfi rolling litestream 0.3.13-r6 —
Wolfi rolling local-path-provisioner 0.0.30-r1 —
Wolfi rolling local-static-provisioner +3 2.7.0-r8 —
Wolfi rolling mailpit +1 1.21.7-r0 —
Wolfi rolling mc +1 0.20241117.193525-r1 —
Wolfi rolling metrics-server +2 0.7.2-r2 —
Wolfi rolling minio +1 0.20241107.005220-r1 —
Wolfi rolling minio-operator +3 6.0.4-r3 —
Wolfi rolling mkcert 1.4.4-r6 —
Wolfi rolling mongo-tools 100.10.0-r4 —
Wolfi rolling nats 0.1.5-r2 —
Wolfi rolling nats-server +1 2.10.23-r1 —
Wolfi rolling nerdctl 2.0.2-r1 —
Wolfi rolling neuvector-sigstore-interface 0_git20240801-r3 —
Wolfi rolling newrelic-nri-statsd 2.10.0-r0 —
Wolfi rolling nfs-subdir-external-provisioner 4.0.18-r11 —
Wolfi rolling nri-kafka +2 3.8.1-r1 —
Wolfi rolling nri-mssql +1 2.13.0-r1 —
Wolfi rolling nsc 2.10.0-r1 —
Wolfi rolling nuclei 3.3.7-r1 —
Wolfi rolling oauth2-proxy +1 7.7.1-r1 —
Wolfi rolling octo-sts +1 0.4.2-r3 —
Wolfi rolling ollama +1 0.5.1-r1 —
Wolfi rolling openbao-k8s +5 1.4.0-r1 —
Wolfi rolling opentelemetry-collector +4 0.115.0-r1 —
Wolfi rolling oras 1.2.1-r1 —
Wolfi rolling osv-scanner 1.9.1-r1 —
Wolfi rolling podman +1 5.3.1-r1 —
Wolfi rolling policy-controller +1 0.11.0-r1 —
Wolfi rolling portieris +1 0.13.22-r1 —
Wolfi rolling postgres-operator +1 1.13.0-r3 —
Wolfi rolling prometheus-adapter 0.12.0-r4 —
Wolfi rolling prometheus-alertmanager +1 0.27.0-r11 —
Wolfi rolling prometheus-operator +3 0.78.2-r1 —
Wolfi rolling prometheus-pushgateway +11 1.10.0-r1 —
Wolfi rolling promxy 0.0.91-r2 —
Wolfi rolling pulumi 3.143.0-r0 —
Wolfi rolling pulumi-kubernetes-operator 1.16.0-r3 —
Wolfi rolling pulumi-language-dotnet 3.71.0-r1 —
Wolfi rolling pulumi-language-java 0.20.0-r0 —
Wolfi rolling pulumi-language-yaml 1.12.0-r1 —
Wolfi rolling q 0.19.2-r9 —
Wolfi rolling rancher-fleet +4 0.11.2-r1 —
Wolfi rolling rclone +1 1.68.2-r2 —
Wolfi rolling rekor +3 1.3.7-r1 —
Wolfi rolling restic +1 0.17.3-r1 —
Wolfi rolling rook +1 1.15.6-r1 —
Wolfi rolling rqlite +1 8.36.0-r1 —
Wolfi rolling sbomqs 0.2.3-r1 —
Wolfi rolling scorecard 5.0.0-r3 —
Wolfi rolling seaweedfs +2 3.80-r1 —
Wolfi rolling secrets-store-csi-driver +1 1.4.7-r1 —
Wolfi rolling secrets-store-csi-driver-provider-gcp +1 1.6.0-r2 —
Wolfi rolling sftpgo-plugin-auth 1.0.10-r1 —
Wolfi rolling sftpgo-plugin-eventstore +1 1.0.19-r1 —
Wolfi rolling sftpgo-plugin-kms 1.0.14-r1 —
Wolfi rolling sftpgo-plugin-pubsub 1.0.13-r1 —
Wolfi rolling sigstore-scaffolding +13 0.7.17-r1 —
Wolfi rolling skaffold 2.13.2-r3 —
Wolfi rolling skopeo +39 1.17.0-r1 —
Wolfi rolling slsa-verifier 2.6.0-r6 —
Wolfi rolling snyk-cli 1.1294.3-r0 —
Wolfi rolling sops 3.9.2-r1 —
Wolfi rolling spark-operator +1 2.0.2-r2 —
Wolfi rolling spegel +1 0.0.27-r2 —
Wolfi rolling spicedb 1.39.1-r0 —
Wolfi rolling spiffe-helper +1 0.9.0-r1 —
Wolfi rolling spire-agent +2 1.11.1-r0 —
Wolfi rolling splunk-otel-collector +2 0.114.0-r1 —
Wolfi rolling spqr +2 2.1.0-r1 —
Wolfi rolling sql_exporter 0.16.0-r1 —
Wolfi rolling src 5.10.0-r1 —
Wolfi rolling src-fingerprint 0.19.0-r19 —
Wolfi rolling step 0.28.2-r1 —
Wolfi rolling step-ca 0.28.1-r1 —
Wolfi rolling step-issuer +1 0.9.6-r1 —
Wolfi rolling swagger 0.31.0-r4 —
Wolfi rolling syft 1.18.0-r1 —
Wolfi rolling tailscale +1 1.78.1-r1 —
Wolfi rolling task 3.40.1-r1 —
Wolfi rolling tdbg +9 1.25.2-r1 —
Wolfi rolling tekton-chains 0.23.0-r1 —
Wolfi rolling temporal +1 1.1.2-r1 —
Wolfi rolling temporal-ui-server +1 2.32.0-r1 —
Wolfi rolling terraform +2 1.5.7-r18 —
Wolfi rolling terraform-docs 0.19.0-r1 —
Wolfi rolling terraform-provider-aws 5.80.0-r1 —
Wolfi rolling terraform-provider-azurerm 4.24.0-r0 —
Wolfi rolling terraform-provider-google 6.13.0-r1 —
Wolfi rolling terraform-provider-sendgrid 1.0.1-r1 —
Wolfi rolling terraform-provider-tls 4.0.6-r1 —
Wolfi rolling terragrunt +1 0.69.12-r0 —
Wolfi rolling tflint +1 0.54.0-r1 —
Wolfi rolling tfsec 1.28.11-r1 —
Wolfi rolling thanos +1 0.37.2-r1 —
Wolfi rolling tkn 0.39.0-r1 —
Wolfi rolling trillian +3 1.7.0-r1 —
Wolfi rolling trivy 0.58.0-r1 —
Wolfi rolling trust-manager 0.14.0-r1 —
Wolfi rolling undock +1 0.8.0-r2 —
Wolfi rolling up +3 No fix yet —
Wolfi rolling vault-benchmark +1 0.3.0-r1 —
Wolfi rolling vault-k8s +2 1.6.0-r1 —
Wolfi rolling vcluster +2 0.21.2-r1 —
Wolfi rolling velero +5 1.15.0-r1 —
Wolfi rolling velero-plugin-for-microsoft-azure +1 1.11.0-r1 —
Wolfi rolling vendir 0.43.0-r0 —
Wolfi rolling vexctl 0.3.0-r2 —
Wolfi rolling weaviate 1.28.0-r1 —
Wolfi rolling wgcf 2.2.23-r1 —
Wolfi rolling wireguard-go 0.0.20230223-r16 —
Wolfi rolling wolfictl 0.27.1-r0 —
Wolfi rolling x509-certificate-exporter +1 3.17.0-r2 —
Wolfi rolling zarf 0.45.0-r0 —
Wolfi rolling zot 2.1.1-r6 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 5 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Go golang.org/x/crypto < 0.31.0 0.31.0 GHSA-v778-237x-gjrc

Advisories 50

References