-
Notifications
You must be signed in to change notification settings - Fork 292
Open
Description
When we scan the nats-streaming latest image we following CRITICAL and HIGH severity issues
nats-streaming-server (gobinary)
================================
Total: 11 (UNKNOWN: 0, LOW: 0, MEDIUM: 9, HIGH: 1, CRITICAL: 1)
┌─────────────────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────────────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ CVE-2023-48795 │ MEDIUM │ fixed │ v0.15.0 │ 0.17.0 │ ssh: Prefix truncation attack on Binary Packet Protocol │
│ │ │ │ │ │ │ (BPP) │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-48795 │
├─────────────────────┼────────────────┼──────────┤ ├───────────────────┼─────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib │ CVE-2024-24790 │ CRITICAL │ │ 1.20.11 │ 1.21.11, 1.22.4 │ golang: net/netip: Unexpected behavior from Is methods for │
│ │ │ │ │ │ │ IPv4-mapped IPv6 addresses │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24790 │
│ ├────────────────┼──────────┤ │ ├─────────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2023-45288 │ HIGH │ │ │ 1.21.9, 1.22.2 │ golang: net/http, x/net/http2: unlimited number of │
│ │ │ │ │ │ │ CONTINUATION frames causes DoS │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-45288 │
│ ├────────────────┼──────────┤ │ ├─────────────────┼──────────────────────────────────────────────────────────────┤
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
golang.org/x/crypto v0.15.0 0.17.0 go-module GHSA-45x7-px36-x8w8 Medium
stdlib go1.20.11 go-module CVE-2024-24790 Critical
stdlib go1.20.11 go-module CVE-2024-24791 High
stdlib go1.20.11 go-module CVE-2023-45285 High
Please provide fix for these security issues.
Metadata
Metadata
Assignees
Labels
No labels