mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
Every command is cd-*: cd, cd-server, cd-repo-server, cd-application-controller, cd-applicationset-controller, cd-cmp-server, cd-commit-server, cd-dex, cd-git-ask-pass, cd-k8s-auth, cd-notification. util/argo is util/cd; util/notification/argocd is util/notification/cd. Preserved deliberately: github.com/argoproj/argocd-example-apps is an EXTERNAL repo used as an e2e fixture, and notifications-engine + pkg/v2 are real dependencies. Renaming a URL we do not own would break the tests. Two bugs I made and caught, both from a careless sed: - s/argo/cd/g turned 'argocd' into 'cdcd' in two directory names - renaming the package declaration left every call site saying argo.X go build ./... exit 0. Co-authored-by: Hanzo Dev <[email protected]>
2951 lines
144 KiB
HTML
2951 lines
144 KiB
HTML
<!DOCTYPE html>
|
||
<html lang="en">
|
||
|
||
<head>
|
||
<meta http-equiv="Content-type" content="text/html; charset=utf-8">
|
||
<meta http-equiv="Content-Language" content="en-us">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
<title>Snyk test report</title>
|
||
<meta name="description" content="26 known vulnerabilities found in 60 vulnerable dependency paths.">
|
||
<base target="_blank">
|
||
<link rel="icon" type="image/png" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.png"
|
||
sizes="194x194">
|
||
<link rel="shortcut icon" href="https://res.cloudinary.com/snyk/image/upload/v1468845142/favicon/favicon.ico">
|
||
<style type="text/css">
|
||
|
||
body {
|
||
-moz-font-feature-settings: "pnum";
|
||
-webkit-font-feature-settings: "pnum";
|
||
font-variant-numeric: proportional-nums;
|
||
display: flex;
|
||
flex-direction: column;
|
||
font-feature-settings: "pnum";
|
||
font-size: 100%;
|
||
line-height: 1.5;
|
||
min-height: 100vh;
|
||
-webkit-text-size-adjust: 100%;
|
||
margin: 0;
|
||
padding: 0;
|
||
background-color: #F5F5F5;
|
||
font-family: 'Arial', 'Helvetica', Calibri, sans-serif;
|
||
}
|
||
|
||
h1,
|
||
h2,
|
||
h3,
|
||
h4,
|
||
h5,
|
||
h6 {
|
||
font-weight: 500;
|
||
}
|
||
|
||
a,
|
||
a:link,
|
||
a:visited {
|
||
border-bottom: 1px solid #4b45a9;
|
||
text-decoration: none;
|
||
color: #4b45a9;
|
||
}
|
||
|
||
a:hover,
|
||
a:focus,
|
||
a:active {
|
||
border-bottom: 1px solid #4b45a9;
|
||
}
|
||
|
||
hr {
|
||
border: none;
|
||
margin: 1em 0;
|
||
border-top: 1px solid #c5c5c5;
|
||
}
|
||
|
||
ul {
|
||
padding: 0 1em;
|
||
margin: 1em 0;
|
||
}
|
||
|
||
code {
|
||
background-color: #EEE;
|
||
color: #333;
|
||
padding: 0.25em 0.5em;
|
||
border-radius: 0.25em;
|
||
}
|
||
|
||
pre {
|
||
background-color: #333;
|
||
font-family: monospace;
|
||
padding: 0.5em 1em 0.75em;
|
||
border-radius: 0.25em;
|
||
font-size: 14px;
|
||
}
|
||
|
||
pre code {
|
||
padding: 0;
|
||
background-color: transparent;
|
||
color: #fff;
|
||
}
|
||
|
||
a code {
|
||
border-radius: .125rem .125rem 0 0;
|
||
padding-bottom: 0;
|
||
color: #4b45a9;
|
||
}
|
||
|
||
a[href^="http://"]:after,
|
||
a[href^="https://"]:after {
|
||
background-image: linear-gradient(transparent,transparent),url("data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20viewBox%3D%220%200%20112%20109%22%3E%3Cg%20id%3D%22Page-1%22%20fill%3D%22none%22%20fill-rule%3D%22evenodd%22%3E%3Cg%20id%3D%22link-external%22%3E%3Cg%20id%3D%22arrow%22%3E%3Cpath%20id%3D%22Line%22%20stroke%3D%22%234B45A9%22%20stroke-width%3D%2215%22%20d%3D%22M88.5%2021l-43%2042.5%22%20stroke-linecap%3D%22square%22%2F%3E%3Cpath%20id%3D%22Triangle%22%20fill%3D%22%234B45A9%22%20d%3D%22M111.2%200v50L61%200z%22%2F%3E%3C%2Fg%3E%3Cpath%20id%3D%22square%22%20fill%3D%22%234B45A9%22%20d%3D%22M66%2015H0v94h94V44L79%2059v35H15V30h36z%22%2F%3E%3C%2Fg%3E%3C%2Fg%3E%3C%2Fsvg%3E");
|
||
background-repeat: no-repeat;
|
||
background-size: .75rem;
|
||
content: "";
|
||
display: inline-block;
|
||
height: .75rem;
|
||
margin-left: .25rem;
|
||
width: .75rem;
|
||
}
|
||
|
||
|
||
/* Layout */
|
||
|
||
[class*=layout-container] {
|
||
margin: 0 auto;
|
||
max-width: 71.25em;
|
||
padding: 1.9em 1.3em;
|
||
position: relative;
|
||
}
|
||
.layout-container--short {
|
||
padding-top: 0;
|
||
padding-bottom: 0;
|
||
max-width: 48.75em;
|
||
}
|
||
|
||
.layout-container--short:after {
|
||
display: block;
|
||
content: "";
|
||
clear: both;
|
||
}
|
||
|
||
/* Header */
|
||
|
||
.header {
|
||
padding-bottom: 1px;
|
||
}
|
||
|
||
.paths {
|
||
margin-left: 8px;
|
||
}
|
||
.header-wrap {
|
||
display: flex;
|
||
flex-direction: row;
|
||
justify-content: space-between;
|
||
padding-top: 2em;
|
||
}
|
||
.project__header {
|
||
background-color: #030328;
|
||
color: #fff;
|
||
margin-bottom: -1px;
|
||
padding-top: 1em;
|
||
padding-bottom: 0.25em;
|
||
border-bottom: 2px solid #BBB;
|
||
}
|
||
|
||
.project__header__title {
|
||
overflow-wrap: break-word;
|
||
word-wrap: break-word;
|
||
word-break: break-all;
|
||
margin-bottom: .1em;
|
||
margin-top: 0;
|
||
}
|
||
|
||
.timestamp {
|
||
float: right;
|
||
clear: none;
|
||
margin-bottom: 0;
|
||
}
|
||
|
||
.meta-counts {
|
||
clear: both;
|
||
display: block;
|
||
flex-wrap: wrap;
|
||
justify-content: space-between;
|
||
margin: 0 0 1.5em;
|
||
color: #fff;
|
||
clear: both;
|
||
font-size: 1.1em;
|
||
}
|
||
|
||
.meta-count {
|
||
display: block;
|
||
flex-basis: 100%;
|
||
margin: 0 1em 1em 0;
|
||
float: left;
|
||
padding-right: 1em;
|
||
border-right: 2px solid #fff;
|
||
}
|
||
|
||
.meta-count:last-child {
|
||
border-right: 0;
|
||
padding-right: 0;
|
||
margin-right: 0;
|
||
}
|
||
|
||
/* Card */
|
||
|
||
.card {
|
||
background-color: #fff;
|
||
border: 1px solid #c5c5c5;
|
||
border-radius: .25rem;
|
||
margin: 0 0 2em 0;
|
||
position: relative;
|
||
min-height: 40px;
|
||
padding: 1.5em;
|
||
}
|
||
|
||
.card__labels {
|
||
position: absolute;
|
||
top: 1.1em;
|
||
left: 0;
|
||
display: flex;
|
||
align-items: center;
|
||
gap: 8px;
|
||
}
|
||
|
||
.card .label {
|
||
background-color: #767676;
|
||
border: 2px solid #767676;
|
||
color: white;
|
||
padding: 0.25rem 0.75rem;
|
||
font-size: 0.875rem;
|
||
text-transform: uppercase;
|
||
display: inline-block;
|
||
margin: 0;
|
||
border-radius: 0.25rem;
|
||
}
|
||
|
||
.card .label__text {
|
||
vertical-align: text-top;
|
||
font-weight: bold;
|
||
}
|
||
|
||
.card .label--critical {
|
||
background-color: #AB1A1A;
|
||
border-color: #AB1A1A;
|
||
}
|
||
|
||
.card .label--high {
|
||
background-color: #CE5019;
|
||
border-color: #CE5019;
|
||
}
|
||
|
||
.card .label--medium {
|
||
background-color: #D68000;
|
||
border-color: #D68000;
|
||
}
|
||
|
||
.card .label--low {
|
||
background-color: #88879E;
|
||
border-color: #88879E;
|
||
}
|
||
|
||
.card .label--exploit {
|
||
background-color: #8B5A96;
|
||
border-color: #8B5A96;
|
||
}
|
||
|
||
.severity--low {
|
||
border-color: #88879E;
|
||
}
|
||
|
||
.severity--medium {
|
||
border-color: #D68000;
|
||
}
|
||
|
||
.severity--high {
|
||
border-color: #CE5019;
|
||
}
|
||
|
||
.severity--critical {
|
||
border-color: #AB1A1A;
|
||
}
|
||
|
||
.card--vuln {
|
||
padding-top: 4em;
|
||
}
|
||
|
||
.card--vuln .card__labels > .label:first-child {
|
||
padding-left: 1.9em;
|
||
padding-right: 1.9em;
|
||
border-radius: 0 0.25rem 0.25rem 0;
|
||
}
|
||
|
||
.card--vuln .card__section h2 {
|
||
font-size: 22px;
|
||
margin-bottom: 0.5em;
|
||
}
|
||
|
||
.card--vuln .card__section p {
|
||
margin: 0 0 0.5em 0;
|
||
}
|
||
|
||
.card--vuln .card__meta {
|
||
padding: 0 0 0 1em;
|
||
margin: 0;
|
||
font-size: 1.1em;
|
||
}
|
||
|
||
.card .card__meta__paths {
|
||
font-size: 0.9em;
|
||
}
|
||
|
||
.card--vuln .card__title {
|
||
font-size: 28px;
|
||
margin-top: 0;
|
||
margin-right: 100px; /* Ensure space for the risk score */
|
||
}
|
||
|
||
.card--vuln .card__cta p {
|
||
margin: 0;
|
||
text-align: right;
|
||
}
|
||
|
||
.risk-score-display {
|
||
position: absolute;
|
||
top: 1.5em;
|
||
right: 1.5em;
|
||
text-align: right;
|
||
z-index: 10;
|
||
}
|
||
|
||
.risk-score-display__label {
|
||
font-size: 0.7em;
|
||
font-weight: bold;
|
||
color: #586069;
|
||
text-transform: uppercase;
|
||
line-height: 1;
|
||
margin-bottom: 3px;
|
||
}
|
||
|
||
.risk-score-display__value {
|
||
font-size: 1.9em;
|
||
font-weight: 600;
|
||
color: #24292e;
|
||
line-height: 1;
|
||
}
|
||
|
||
.source-panel {
|
||
clear: both;
|
||
display: flex;
|
||
justify-content: flex-start;
|
||
flex-direction: column;
|
||
align-items: flex-start;
|
||
padding: 0.5em 0;
|
||
width: fit-content;
|
||
}
|
||
|
||
|
||
|
||
</style>
|
||
<style type="text/css">
|
||
.metatable {
|
||
text-size-adjust: 100%;
|
||
-webkit-font-smoothing: antialiased;
|
||
-webkit-box-direction: normal;
|
||
color: inherit;
|
||
font-feature-settings: "pnum";
|
||
box-sizing: border-box;
|
||
background: transparent;
|
||
border: 0;
|
||
font: inherit;
|
||
font-size: 100%;
|
||
margin: 0;
|
||
outline: none;
|
||
padding: 0;
|
||
text-align: left;
|
||
text-decoration: none;
|
||
vertical-align: baseline;
|
||
z-index: auto;
|
||
margin-top: 12px;
|
||
border-collapse: collapse;
|
||
border-spacing: 0;
|
||
font-variant-numeric: tabular-nums;
|
||
max-width: 51.75em;
|
||
}
|
||
|
||
tbody {
|
||
text-size-adjust: 100%;
|
||
-webkit-font-smoothing: antialiased;
|
||
-webkit-box-direction: normal;
|
||
color: inherit;
|
||
font-feature-settings: "pnum";
|
||
border-collapse: collapse;
|
||
border-spacing: 0;
|
||
box-sizing: border-box;
|
||
background: transparent;
|
||
border: 0;
|
||
font: inherit;
|
||
font-size: 100%;
|
||
margin: 0;
|
||
outline: none;
|
||
padding: 0;
|
||
text-align: left;
|
||
text-decoration: none;
|
||
vertical-align: baseline;
|
||
z-index: auto;
|
||
display: flex;
|
||
flex-wrap: wrap;
|
||
}
|
||
|
||
.meta-row {
|
||
text-size-adjust: 100%;
|
||
-webkit-font-smoothing: antialiased;
|
||
-webkit-box-direction: normal;
|
||
color: inherit;
|
||
font-feature-settings: "pnum";
|
||
border-collapse: collapse;
|
||
border-spacing: 0;
|
||
box-sizing: border-box;
|
||
background: transparent;
|
||
border: 0;
|
||
font: inherit;
|
||
font-size: 100%;
|
||
outline: none;
|
||
text-align: left;
|
||
text-decoration: none;
|
||
vertical-align: baseline;
|
||
z-index: auto;
|
||
display: flex;
|
||
align-items: start;
|
||
border-top: 1px solid #d3d3d9;
|
||
padding: 8px 0 0 0;
|
||
border-bottom: none;
|
||
margin: 8px;
|
||
width: 47.75%;
|
||
}
|
||
|
||
.meta-row-label {
|
||
text-size-adjust: 100%;
|
||
-webkit-font-smoothing: antialiased;
|
||
-webkit-box-direction: normal;
|
||
font-feature-settings: "pnum";
|
||
border-collapse: collapse;
|
||
border-spacing: 0;
|
||
color: #4c4a73;
|
||
box-sizing: border-box;
|
||
background: transparent;
|
||
border: 0;
|
||
font: inherit;
|
||
margin: 0;
|
||
outline: none;
|
||
text-decoration: none;
|
||
z-index: auto;
|
||
align-self: start;
|
||
flex: 1;
|
||
font-size: 1rem;
|
||
line-height: 1.5rem;
|
||
padding: 0;
|
||
text-align: left;
|
||
vertical-align: top;
|
||
text-transform: none;
|
||
letter-spacing: 0;
|
||
}
|
||
|
||
.meta-row-value {
|
||
text-size-adjust: 100%;
|
||
-webkit-font-smoothing: antialiased;
|
||
-webkit-box-direction: normal;
|
||
color: inherit;
|
||
font-feature-settings: "pnum";
|
||
border-collapse: collapse;
|
||
border-spacing: 0;
|
||
word-break: break-word;
|
||
box-sizing: border-box;
|
||
background: transparent;
|
||
border: 0;
|
||
font: inherit;
|
||
font-size: 100%;
|
||
margin: 0;
|
||
outline: none;
|
||
padding: 0;
|
||
text-align: right;
|
||
text-decoration: none;
|
||
vertical-align: baseline;
|
||
z-index: auto;
|
||
}
|
||
</style>
|
||
</head>
|
||
|
||
<body class="section-projects">
|
||
<main class="layout-stacked">
|
||
<div class="layout-stacked__header header">
|
||
<header class="project__header">
|
||
<div class="layout-container">
|
||
<a class="brand" href="https://snyk.io" title="Snyk">
|
||
<svg width="68px" height="35px" viewBox="0 0 68 35" version="1.1" xmlns="http://www.w3.org/2000/svg" role="img">
|
||
<title>Snyk - Open Source Security</title>
|
||
<g stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">
|
||
<g fill="#fff">
|
||
<path d="M5.732,27.278 C3.445,27.278 1.589,26.885 0,26.124 L0.483,22.472 C2.163,23.296 4.056,23.689 5.643,23.689 C6.801,23.689 7.563,23.295 7.563,22.599 C7.563,20.594 0.333,21.076 0.333,15.839 C0.333,12.491 3.407,10.729 7.259,10.729 C9.179,10.729 11.161,11.249 12.444,11.704 L11.924,15.294 C10.577,14.774 8.747,14.291 7.222,14.291 C6.282,14.291 5.518,14.621 5.518,15.231 C5.518,17.208 12.903,16.815 12.903,21.925 C12.903,25.325 9.877,27.277 5.733,27.277 L5.732,27.278 Z M25.726,26.936 L25.726,17.894 C25.726,15.827 24.811,14.85 23.069,14.85 C22.219,14.85 21.329,15.09 20.719,15.46 L20.719,26.936 L15.352,26.936 L15.352,11.262 L20.602,10.83 L20.474,13.392 L20.652,13.392 C21.784,11.87 23.702,10.716 25.992,10.716 C28.736,10.716 31.112,12.416 31.112,16.436 L31.112,26.936 L25.724,26.936 L25.726,26.936 Z M61.175,26.936 L56.879,19.479 L56.446,19.479 L56.446,26.935 L51.082,26.935 L51.082,8.37 L56.447,0 L56.447,17.323 C57.515,16.017 61.112,11.059 61.112,11.059 L67.732,11.059 L61.454,17.689 L67.949,26.95 L61.175,26.95 L61.175,26.938 L61.175,26.936 Z M44.13,11.11 L41.93,18.262 C41.5,19.606 41.08,22.079 41.08,22.079 C41.08,22.079 40.75,19.516 40.292,18.172 L37.94,11.108 L31.928,11.108 L38.462,26.935 C37.572,29.04 36.199,30.815 34.369,30.815 C34.039,30.815 33.709,30.802 33.389,30.765 L31.255,34.061 C31.928,34.441 33.212,34.835 34.737,34.835 C38.703,34.835 41.359,31.627 43.215,26.885 L49.443,11.108 L44.132,11.108 L44.13,11.11 Z"></path>
|
||
</g>
|
||
</g>
|
||
</svg>
|
||
</a>
|
||
<div class="header-wrap">
|
||
<h1 class="project__header__title">Snyk test report</h1>
|
||
|
||
<p class="timestamp">July 5th 2026, 12:44:07 am (UTC+00:00)</p>
|
||
</div>
|
||
<div class="source-panel">
|
||
<span>Scanned the following paths:</span>
|
||
<ul>
|
||
<li class="paths">quay.io/argoproj/argocd:latest/argoproj/argocd/Dockerfile (deb)</li>
|
||
<li class="paths">quay.io/argoproj/argocd:latest/argoproj/argo-cd/v3//usr/local/bin/argocd (gomodules)</li>
|
||
<li class="paths">quay.io/argoproj/argocd:latest//usr/local/bin/git-lfs (gomodules)</li>
|
||
<li class="paths">quay.io/argoproj/argocd:latest//usr/local/bin/kustomize (gomodules)</li>
|
||
<li class="paths">quay.io/argoproj/argocd:latest/helm/v4//usr/local/bin/helm (gomodules)</li>
|
||
<li class="paths">quay.io/argoproj/argocd:latest/canonical/pebble//usr/bin/pebble (gomodules)</li>
|
||
</ul>
|
||
</div>
|
||
|
||
<div class="meta-counts">
|
||
<div class="meta-count"><span>26</span> <span>known vulnerabilities</span></div>
|
||
<div class="meta-count"><span>60 vulnerable dependency paths</span></div>
|
||
<div class="meta-count"><span>2498</span> <span>dependencies</span></div>
|
||
</div><!-- .meta-counts -->
|
||
</div><!-- .layout-container--short -->
|
||
</header><!-- .project__header -->
|
||
</div><!-- .layout-stacked__header -->
|
||
|
||
<div class="layout-container" style="padding-top: 35px;">
|
||
<div class="cards--vuln filter--patch filter--ignore">
|
||
<div class="card card--vuln disclosure--not-new severity--critical" data-snyk-test="critical">
|
||
<h2 class="card__title">Improper Authentication</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--critical">
|
||
<span class="label__text">critical severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest <span class="list-paths__item__arrow">›</span> /usr/local/bin/git-lfs
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: golang
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
golang.org/x/net/idna
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
go-distribution@command-line-arguments@* and golang.org/x/net/[email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
go-distribution@command-line-arguments@*
|
||
<span class="list-paths__item__arrow">›</span>
|
||
golang.org/x/net/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="overview">Overview</h2>
|
||
<p>Affected versions of this package are vulnerable to Improper Authentication via the <code>ToASCII</code> and <code>ToUnicode</code> functions. An attacker can bypass hostname validation by submitting Punycode-encoded labels that decode to ASCII-only labels, potentially leading to privilege escalation in applications that rely on these functions for security checks.</p>
|
||
<p><strong>Note:</strong> The fix depends on the Go toolchain in use having Unicode version 16 or later, which is planned for the 1.27 release.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>Upgrade <code>golang.org/x/net/idna</code> to version 0.54.0 or higher.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="https://github.com/golang/net/commit/8c4c965e028475082408749b50ed7a686df0d265">GitHub Commit</a></li>
|
||
<li><a href="https://pkg.go.dev/vuln/GO-2026-5026">Go Advisory</a></li>
|
||
<li><a href="https://go.dev/cl/767220">Go Commit</a></li>
|
||
<li><a href="https://go.dev/issue/78760">Go Issue</a></li>
|
||
<li><a href="https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8">Google Groups Forum</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-GOLANG-GOLANGORGXNETIDNA-17116876">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--high" data-snyk-test="high">
|
||
<h2 class="card__title">Infinite loop</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--high">
|
||
<span class="label__text">high severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest <span class="list-paths__item__arrow">›</span> /usr/local/bin/git-lfs
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: golang
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
golang.org/x/net/http2
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
go-distribution@command-line-arguments@* and golang.org/x/net/[email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
go-distribution@command-line-arguments@*
|
||
<span class="list-paths__item__arrow">›</span>
|
||
golang.org/x/net/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="overview">Overview</h2>
|
||
<p><a href="https://pkg.go.dev/golang.org/x/net/http2">golang.org/x/net/http2</a> is a work-in-progress HTTP/2 implementation for Go.</p>
|
||
<p>Affected versions of this package are vulnerable to Infinite loop. <br><br><strong>Go Vulnerability Report:</strong><br></p>
|
||
<p>When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a <code>SETTINGS_MAX_FRAME_SIZE</code> with a value of 0.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>Upgrade <code>golang.org/x/net/http2</code> to version 0.53.0 or higher.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="https://pkg.go.dev/vuln/GO-2026-4918">Go Advisory</a></li>
|
||
<li><a href="https://go.dev/cl/761581">Go Commit</a></li>
|
||
<li><a href="https://go.dev/cl/761640">Go Commit</a></li>
|
||
<li><a href="https://go.dev/issue/78476">Go Issue</a></li>
|
||
<li><a href="https://groups.google.com/g/golang-announce/c/qcCIEXso47M">Google Groups Forum</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-GOLANG-GOLANGORGXNETHTTP2-16535157">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">Authentication Bypass</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
util-linux/libblkid1
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and util-linux/[email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/bsdutils@1:2.41.3-3ubuntu2
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/login@1:4.16.0-2+really2.41.3-3ubuntu2
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
util-linux/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>util-linux</code> package and not the <code>util-linux</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>A flaw was found in util-linux. Improper hostname canonicalization in the <code>login(1)</code> utility, when invoked with the <code>-h</code> option, can modify the supplied remote hostname before setting <code>PAM_RHOST</code>. A remote attacker could exploit this by providing a specially crafted hostname, potentially bypassing host-based Pluggable Authentication Modules (PAM) access control rules that rely on fully qualified domain names. This could lead to unauthorized access.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>util-linux</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-3184">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-3184</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:7180">https://access.redhat.com/errata/RHSA-2026:7180</a></li>
|
||
<li><a href="https://access.redhat.com/security/cve/CVE-2026-3184">https://access.redhat.com/security/cve/CVE-2026-3184</a></li>
|
||
<li><a href="https://bugzilla.redhat.com/show_bug.cgi?id=2442570">https://bugzilla.redhat.com/show_bug.cgi?id=2442570</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-UTILLINUX-16238600">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">Directory Traversal</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
tar
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and [email protected]+dfsg-4ubuntu0.1
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]+dfsg-4ubuntu0.1
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]+dfsg-4ubuntu0.1
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>tar</code> package and not the <code>tar</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>tar</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-45582">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-45582</a></li>
|
||
<li><a href="https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md">https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md</a></li>
|
||
<li><a href="https://www.gnu.org/software/tar/">https://www.gnu.org/software/tar/</a></li>
|
||
<li><a href="https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html">https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html</a></li>
|
||
<li><a href="https://www.gnu.org/software/tar/manual/html_node/Integrity.html">https://www.gnu.org/software/tar/manual/html_node/Integrity.html</a></li>
|
||
<li><a href="https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html">https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html</a></li>
|
||
<li><a href="http://www.openwall.com/lists/oss-security/2025/11/01/6">http://www.openwall.com/lists/oss-security/2025/11/01/6</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-TAR-16230261">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-35357</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
rust-coreutils
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and [email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]+0.0.0~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>rust-coreutils</code> package and not the <code>rust-coreutils</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>rust-coreutils</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35357">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35357</a></li>
|
||
<li><a href="https://github.com/uutils/coreutils/issues/10011">https://github.com/uutils/coreutils/issues/10011</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-RUSTCOREUTILS-16238559">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-35373</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
rust-coreutils
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and [email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]+0.0.0~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>rust-coreutils</code> package and not the <code>rust-coreutils</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the links correctly, the uutils implementation enforces UTF-8 encoding, resulting in a failure to stat the file and a non-zero exit code. In environments where automated scripts or system tasks process valid but non-UTF-8 filenames common on Unix filesystems, this divergence causes the utility to fail, leading to a local denial of service for those specific operations.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>rust-coreutils</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35373">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35373</a></li>
|
||
<li><a href="https://github.com/uutils/coreutils/pull/11403">https://github.com/uutils/coreutils/pull/11403</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-RUSTCOREUTILS-16238622">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-35367</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
rust-coreutils
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and [email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]+0.0.0~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>rust-coreutils</code> package and not the <code>rust-coreutils</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>rust-coreutils</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35367">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35367</a></li>
|
||
<li><a href="https://github.com/uutils/coreutils/issues/10021">https://github.com/uutils/coreutils/issues/10021</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-RUSTCOREUTILS-16238745">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-35348</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
rust-coreutils
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and [email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]+0.0.0~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>rust-coreutils</code> package and not the <code>rust-coreutils</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>rust-coreutils</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35348">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35348</a></li>
|
||
<li><a href="https://github.com/uutils/coreutils/issues/9696">https://github.com/uutils/coreutils/issues/9696</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-RUSTCOREUTILS-16238933">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-35364</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
rust-coreutils
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and [email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]+0.0.0~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>rust-coreutils</code> package and not the <code>rust-coreutils</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>rust-coreutils</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35364">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35364</a></li>
|
||
<li><a href="https://github.com/uutils/coreutils/issues/10015">https://github.com/uutils/coreutils/issues/10015</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-RUSTCOREUTILS-16239294">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-35360</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
rust-coreutils
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and [email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]+0.0.0~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>rust-coreutils</code> package and not the <code>rust-coreutils</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>rust-coreutils</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35360">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35360</a></li>
|
||
<li><a href="https://github.com/uutils/coreutils/issues/10019">https://github.com/uutils/coreutils/issues/10019</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-RUSTCOREUTILS-16239352">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-35352</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
rust-coreutils
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and [email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]+0.0.0~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
coreutils-from/[email protected]~ubuntu25
|
||
<span class="list-paths__item__arrow">›</span>
|
||
[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>rust-coreutils</code> package and not the <code>rust-coreutils</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mkfifo utility of uutils coreutils. The utility creates a FIFO and then performs a path-based chmod to set permissions. A local attacker with write access to the parent directory can swap the newly created FIFO for a symbolic link between these two operations. This redirects the chmod call to an arbitrary file, potentially enabling privilege escalation if the utility is run with elevated privileges.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>rust-coreutils</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35352">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-35352</a></li>
|
||
<li><a href="http://www.openwall.com/lists/oss-security/2026/05/04/4">http://www.openwall.com/lists/oss-security/2026/05/04/4</a></li>
|
||
<li><a href="http://www.openwall.com/lists/oss-security/2026/05/04/5">http://www.openwall.com/lists/oss-security/2026/05/04/5</a></li>
|
||
<li><a href="http://www.openwall.com/lists/oss-security/2026/05/04/6">http://www.openwall.com/lists/oss-security/2026/05/04/6</a></li>
|
||
<li><a href="https://github.com/uutils/coreutils/issues/10020">https://github.com/uutils/coreutils/issues/10020</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-RUSTCOREUTILS-16239385">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">Uncontrolled Recursion</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
p11-kit/libp11-kit0
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
gnutls28/[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
p11-kit/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>p11-kit</code> package and not the <code>p11-kit</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>p11-kit</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13757">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-13757</a></li>
|
||
<li><a href="https://access.redhat.com/security/cve/CVE-2026-13757">https://access.redhat.com/security/cve/CVE-2026-13757</a></li>
|
||
<li><a href="https://bugzilla.redhat.com/show_bug.cgi?id=2494556">https://bugzilla.redhat.com/show_bug.cgi?id=2494556</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-P11KIT-17740409">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-4438</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
glibc/libc-bin
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and glibc/[email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>glibc</code> package and not the <code>glibc</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>glibc</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4438">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4438</a></li>
|
||
<li><a href="https://sourceware.org/bugzilla/show_bug.cgi?id=34015">https://sourceware.org/bugzilla/show_bug.cgi?id=34015</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-GLIBC-16239002">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-4046</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
glibc/libc-bin
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and glibc/[email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>glibc</code> package and not the <code>glibc</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.</p>
|
||
<p>This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>glibc</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4046">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4046</a></li>
|
||
<li><a href="https://sourceware.org/bugzilla/show_bug.cgi?id=33980">https://sourceware.org/bugzilla/show_bug.cgi?id=33980</a></li>
|
||
<li><a href="https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD">https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD</a></li>
|
||
<li><a href="https://inbox.sourceware.org/libc-announce/[email protected]/T/#u">https://inbox.sourceware.org/libc-announce/[email protected]/T/#u</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-GLIBC-16239580">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-6238</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
glibc/libc-bin
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and glibc/[email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>glibc</code> package and not the <code>glibc</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to validate the RDATA content against the RDATA length in a DNS response when processing LOC, CERT, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.</p>
|
||
<p>These functions are for application debugging only and hence not in the path of code executed by the DNS resolver. Further, they have been deprecated since version 2.34 and should not be used by any new applications. Applications should consider porting away from these interfaces since they may be removed in future versions.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>glibc</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6238">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6238</a></li>
|
||
<li><a href="https://inbox.sourceware.org/libc-announce/[email protected]/T/#u">https://inbox.sourceware.org/libc-announce/[email protected]/T/#u</a></li>
|
||
<li><a href="https://sourceware.org/bugzilla/show_bug.cgi?id=34069">https://sourceware.org/bugzilla/show_bug.cgi?id=34069</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-GLIBC-16338133">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-5435</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
glibc/libc-bin
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest and glibc/[email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
glibc/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>glibc</code> package and not the <code>glibc</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplied buffer length, and can result in an out-of-bounds write when printing TSIG records.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>glibc</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-5435">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-5435</a></li>
|
||
<li><a href="https://inbox.sourceware.org/libc-announce/[email protected]/T/#u">https://inbox.sourceware.org/libc-announce/[email protected]/T/#u</a></li>
|
||
<li><a href="https://sourceware.org/bugzilla/show_bug.cgi?id=34033">https://sourceware.org/bugzilla/show_bug.cgi?id=34033</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-GLIBC-16338221">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">Improper Validation of Specified Type of Input</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argo-cd/v3 <span class="list-paths__item__arrow">›</span> /usr/local/bin/argocd
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: golang
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
github.com/vmihailenco/msgpack/v5
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
github.com/argoproj/argo-cd/v3@* and github.com/vmihailenco/msgpack/[email protected]
|
||
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
github.com/argoproj/argo-cd/v3@*
|
||
<span class="list-paths__item__arrow">›</span>
|
||
github.com/vmihailenco/msgpack/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="overview">Overview</h2>
|
||
<p>Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the calls plugin when handling websocket messages containing malformed msgpack frames. An attacker can cause the server to consume excessive memory and crash by sending specially crafted websocket requests.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>github.com/vmihailenco/msgpack/v5</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="https://github.com/mattermost/msgpack/commit/2f9c67d7e57f">GitHub Commit</a></li>
|
||
<li><a href="https://mattermost.com/security-updates">Mattermost Security Updates</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMVMIHAILENCOMSGPACKV5-15702238">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">Algorithmic Complexity</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
expat/libexpat1
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
expat/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>expat</code> package and not the <code>expat</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>expat</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-66382">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-66382</a></li>
|
||
<li><a href="https://github.com/libexpat/libexpat/issues/1076">https://github.com/libexpat/libexpat/issues/1076</a></li>
|
||
<li><a href="http://www.openwall.com/lists/oss-security/2025/12/02/1">http://www.openwall.com/lists/oss-security/2025/12/02/1</a></li>
|
||
<li><a href="https://cert-portal.siemens.com/productcert/html/ssa-082556.html">https://cert-portal.siemens.com/productcert/html/ssa-082556.html</a></li>
|
||
<li><a href="https://cert-portal.siemens.com/productcert/html/ssa-253495.html">https://cert-portal.siemens.com/productcert/html/ssa-253495.html</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-EXPAT-16231174">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--medium" data-snyk-test="medium">
|
||
<h2 class="card__title">CVE-2026-11856</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--medium">
|
||
<span class="label__text">medium severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
curl/libcurl3t64-gnutls
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>curl</code> package and not the <code>curl</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>Successfully using libcurl to do a transfer to a specific HTTP origin
|
||
(<code>hostA</code>) with <strong>Digest</strong> authentication and then changing the origin to a
|
||
different one (<code>hostB</code>) for a second transfer, reusing the same handle, makes
|
||
libcurl wrongly pass on the <code>Authorization:</code> header field meant for <code>hostA</code>,
|
||
to <code>hostB</code>.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>curl</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11856">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11856</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-11856.html">https://curl.se/docs/CVE-2026-11856.html</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-11856.json">https://curl.se/docs/CVE-2026-11856.json</a></li>
|
||
<li><a href="https://hackerone.com/reports/3793260">https://hackerone.com/reports/3793260</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-CURL-17486821">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
|
||
<h2 class="card__title">Stack-based Buffer Overflow</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--low">
|
||
<span class="label__text">low severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
gnutls28/libgnutls30t64
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
gnutls28/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
<span class="list-paths__item__arrow">›</span>
|
||
rtmpdump/[email protected]+20151223.gitfa8646d.1-3
|
||
<span class="list-paths__item__arrow">›</span>
|
||
gnutls28/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>gnutls28</code> package and not the <code>gnutls28</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>gnutls28</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-9820">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2025-9820</a></li>
|
||
<li><a href="https://access.redhat.com/security/cve/CVE-2025-9820">https://access.redhat.com/security/cve/CVE-2025-9820</a></li>
|
||
<li><a href="https://bugzilla.redhat.com/show_bug.cgi?id=2392528">https://bugzilla.redhat.com/show_bug.cgi?id=2392528</a></li>
|
||
<li><a href="https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5">https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5</a></li>
|
||
<li><a href="https://gitlab.com/gnutls/gnutls/-/issues/1732">https://gitlab.com/gnutls/gnutls/-/issues/1732</a></li>
|
||
<li><a href="https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18">https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18</a></li>
|
||
<li><a href="http://www.openwall.com/lists/oss-security/2025/11/20/2">http://www.openwall.com/lists/oss-security/2025/11/20/2</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:3477">https://access.redhat.com/errata/RHSA-2026:3477</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:4188">https://access.redhat.com/errata/RHSA-2026:4188</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:4655">https://access.redhat.com/errata/RHSA-2026:4655</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:4943">https://access.redhat.com/errata/RHSA-2026:4943</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:5585">https://access.redhat.com/errata/RHSA-2026:5585</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:5606">https://access.redhat.com/errata/RHSA-2026:5606</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:7329">https://access.redhat.com/errata/RHSA-2026:7329</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:7477">https://access.redhat.com/errata/RHSA-2026:7477</a></li>
|
||
<li><a href="https://access.redhat.com/errata/RHSA-2026:13812">https://access.redhat.com/errata/RHSA-2026:13812</a></li>
|
||
<li><a href="https://cert-portal.siemens.com/productcert/html/ssa-032379.html">https://cert-portal.siemens.com/productcert/html/ssa-032379.html</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-GNUTLS28-16237610">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
|
||
<h2 class="card__title">CVE-2026-11564</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--low">
|
||
<span class="label__text">low severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
curl/libcurl3t64-gnutls
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>curl</code> package and not the <code>curl</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>libcurl keeps previously used connections in a connection pool for subsequent
|
||
transfers to reuse if one of them matches the setup.</p>
|
||
<p>An easy handle that first uses default native CA trust can continue trusting
|
||
the native platform store after the application switches that same handle to
|
||
custom CA material for a later transfer.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>curl</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11564">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11564</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-11564.html">https://curl.se/docs/CVE-2026-11564.html</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-11564.json">https://curl.se/docs/CVE-2026-11564.json</a></li>
|
||
<li><a href="https://hackerone.com/reports/3788984">https://hackerone.com/reports/3788984</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-CURL-17486731">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
|
||
<h2 class="card__title">CVE-2026-12064</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--low">
|
||
<span class="label__text">low severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
curl/libcurl3t64-gnutls
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>curl</code> package and not the <code>curl</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>When a user invokes curl using a schemeless URL combined with
|
||
<code>--proto-default</code> sftp (or scp), a disconnect occurs between the tool layer
|
||
and libcurl. The tool layer incorrectly infers the URL scheme, which
|
||
erroneously bypasses the initialization of critical SSH security options like
|
||
CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the
|
||
libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes
|
||
the connection via SFTP/SCP as specified. Because the tool layer skipped the
|
||
security configuration, these SSH host verification options are silently
|
||
omitted, causing curl to connect to an unverified SSH remote host without
|
||
throwing an error.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>curl</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-12064">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-12064</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-12064.html">https://curl.se/docs/CVE-2026-12064.html</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-12064.json">https://curl.se/docs/CVE-2026-12064.json</a></li>
|
||
<li><a href="https://hackerone.com/reports/3797526">https://hackerone.com/reports/3797526</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-CURL-17486737">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
|
||
<h2 class="card__title">CVE-2026-11352</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--low">
|
||
<span class="label__text">low severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
curl/libcurl3t64-gnutls
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>curl</code> package and not the <code>curl</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server
|
||
to trigger a remote denial of service against a curl or libcurl client.
|
||
Because the helper function discards zero-length UDP datagrams before counting
|
||
them toward the per-call packet budget, a connected QUIC peer can continuously
|
||
stream empty datagrams to indefinitely stall the client.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>curl</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11352">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11352</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-11352.html">https://curl.se/docs/CVE-2026-11352.html</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-11352.json">https://curl.se/docs/CVE-2026-11352.json</a></li>
|
||
<li><a href="https://hackerone.com/reports/3783438">https://hackerone.com/reports/3783438</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-CURL-17486779">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
|
||
<h2 class="card__title">CVE-2026-10536</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--low">
|
||
<span class="label__text">low severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
curl/libcurl3t64-gnutls
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>curl</code> package and not the <code>curl</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>A use-after-free vulnerability exists in libcurl when an application
|
||
configures an HTTP/2 stream-dependency tree via <code>CURLOPT_STREAM_DEPENDS</code> or
|
||
<code>CURLOPT_STREAM_DEPENDS_E</code>, subsequently invokes <code>curl_easy_reset()</code>, and
|
||
finally terminates the handle with <code>curl_easy_cleanup()</code>. During this final
|
||
cleanup phase, libcurl attempts to access and modify an internal structure
|
||
that was already freed during the reset operation.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>curl</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-10536">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-10536</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-10536.html">https://curl.se/docs/CVE-2026-10536.html</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-10536.json">https://curl.se/docs/CVE-2026-10536.json</a></li>
|
||
<li><a href="https://hackerone.com/reports/3751697">https://hackerone.com/reports/3751697</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-CURL-17486843">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
|
||
<h2 class="card__title">CVE-2026-8932</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--low">
|
||
<span class="label__text">low severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
curl/libcurl3t64-gnutls
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>curl</code> package and not the <code>curl</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>libcurl would reuse a previously created connection even when some mTLS config
|
||
related option had been changed that should have prohibited reuse.</p>
|
||
<p>libcurl keeps previously used connections in a connection pool for subsequent
|
||
transfers to reuse if one of them matches the setup. However, some TLS
|
||
settings related to client certificates were left out from the configuration
|
||
match checks, making them match too easily. In particular options related to
|
||
the private key.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>curl</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-8932">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-8932</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-8932.html">https://curl.se/docs/CVE-2026-8932.html</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-8932.json">https://curl.se/docs/CVE-2026-8932.json</a></li>
|
||
<li><a href="https://hackerone.com/reports/3733910">https://hackerone.com/reports/3733910</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-CURL-17486874">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
<div class="card card--vuln disclosure--not-new severity--low" data-snyk-test="low">
|
||
<h2 class="card__title">CVE-2026-11586</h2>
|
||
<div class="card__section">
|
||
|
||
<div class="card__labels">
|
||
<div class="label label--low">
|
||
<span class="label__text">low severity</span>
|
||
</div>
|
||
<div class="label label--exploit">
|
||
<span class="label__text">Exploit: Not Defined</span>
|
||
</div>
|
||
</div>
|
||
|
||
<hr/>
|
||
|
||
<ul class="card__meta">
|
||
<li class="card__meta__item">
|
||
Manifest file: quay.io/argoproj/argocd:latest/argoproj/argocd <span class="list-paths__item__arrow">›</span> Dockerfile
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Package Manager: ubuntu:26.04
|
||
</li>
|
||
<li class="card__meta__item">
|
||
Vulnerable module:
|
||
|
||
curl/libcurl3t64-gnutls
|
||
</li>
|
||
|
||
<li class="card__meta__item">Introduced through:
|
||
|
||
|
||
docker-image|quay.io/argoproj/argocd@latest, git@1:2.53.0-1ubuntu1 and others
|
||
</li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
|
||
<h3 class="card__section__title">Detailed paths</h3>
|
||
|
||
<ul class="card__meta__paths">
|
||
<li>
|
||
<span class="list-paths__item__introduced"><em>Introduced through</em>:
|
||
docker-image|quay.io/argoproj/argocd@latest
|
||
<span class="list-paths__item__arrow">›</span>
|
||
git@1:2.53.0-1ubuntu1
|
||
<span class="list-paths__item__arrow">›</span>
|
||
curl/[email protected]
|
||
|
||
</span>
|
||
|
||
</li>
|
||
</ul><!-- .list-paths -->
|
||
|
||
</div><!-- .card__section -->
|
||
|
||
<hr/>
|
||
<!-- Overview -->
|
||
<h2 id="nvd-description">NVD Description</h2>
|
||
<p><strong><em>Note:</em></strong> <em>Versions mentioned in the description apply only to the upstream <code>curl</code> package and not the <code>curl</code> package as distributed by <code>Ubuntu</code>.</em>
|
||
<em>See <code>How to fix?</code> for <code>Ubuntu:26.04</code> relevant fixed versions and status.</em></p>
|
||
<p>By default, curl automatically responds to WebSocket PING frames. Because curl
|
||
lacks an upper bound on memory allocation for unacknowledged frames, a
|
||
malicious server can exhaust all available memory by flooding curl with rapid,
|
||
sequential PING messages.</p>
|
||
<h2 id="remediation">Remediation</h2>
|
||
<p>There is no fixed version for <code>Ubuntu:26.04</code> <code>curl</code>.</p>
|
||
<h2 id="references">References</h2>
|
||
<ul>
|
||
<li><a href="http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11586">http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-11586</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-11586.html">https://curl.se/docs/CVE-2026-11586.html</a></li>
|
||
<li><a href="https://curl.se/docs/CVE-2026-11586.json">https://curl.se/docs/CVE-2026-11586.json</a></li>
|
||
<li><a href="https://hackerone.com/reports/3788931">https://hackerone.com/reports/3788931</a></li>
|
||
</ul>
|
||
|
||
<hr/>
|
||
|
||
<div class="cta card__cta">
|
||
<p><a href="https://snyk.io/vuln/SNYK-UBUNTU2604-CURL-17486889">More about this vulnerability</a></p>
|
||
</div>
|
||
|
||
</div><!-- .card -->
|
||
</div><!-- cards -->
|
||
</div>
|
||
</main><!-- .layout-stacked__content -->
|
||
</body>
|
||
|
||
</html>
|