{ "@context": "https://openvex.dev/ns/v0.2.0", "@id": "https://docs.kasten.io/downloads/9.0.9/sboms/vex-9.0.9.openvex.json", "author": "Kasten by Veeam PSIRT", "role": "Document Creator", "timestamp": "2026-10-22T21:26:57Z", "last_updated": "2026-10-22T21:26:57Z", "version": 1, "tooling": "k10-dev image vex (govulncheck v1.8.0)", "statements": [ { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/aggregatedapis@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images/aggregatedapis", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 aggregatedapis 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /aggregatedapis-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/aggregatedapis@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images/aggregatedapis", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 aggregatedapis 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /aggregatedapis-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/aggregatedapis@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images/aggregatedapis", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/aggregatedapis@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images/aggregatedapis", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/aggregatedapis@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images/aggregatedapis", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/aggregatedapis@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images/aggregatedapis", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 aggregatedapis 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /aggregatedapis-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6094", "name": "GO-2026-6094", "description": "JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go", "aliases": [ "GHSA-gcjh-h69q-9w9g" ] }, "products": [ { "@id": "pkg:generic/aggregatedapis@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images/aggregatedapis", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "govulncheck binary analysis of K10 aggregatedapis 9.0.9 (pkg:golang/github.com/google/cel-go@v0.29.0): the vulnerable package is imported but no vulnerable function is called in /aggregatedapis-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6107", "name": "GO-2026-6107", "description": "Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3", "aliases": [ "CVE-2026-73500", "GHSA-6vch-q96h-7gc3" ] }, "products": [ { "@id": "pkg:generic/aggregatedapis@9.0.9", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images/aggregatedapis", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 aggregatedapis 9.0.9 (pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5): the vulnerable package is not imported in /aggregatedapis-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/aggregatedapis@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images/aggregatedapis", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/aggregatedapis@sha256%3A4647b2dc142f8416e2cb736682f57c7f68da130f1d0510857dbf510dc939ec6a?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/auth@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images/auth", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 auth 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /auth-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/auth@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images/auth", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 auth 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /auth-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/auth@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images/auth", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/auth@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images/auth", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/auth@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images/auth", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/auth@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images/auth", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 auth 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /auth-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/auth@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images/auth", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/auth@sha256%3Addad9a83984f0c7ad027441511ee4cdc25b8378a865a1061c80d86eb0568b709?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/bloblifecyclemanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images/bloblifecyclemanager", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 bloblifecyclemanager 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /bloblifecyclemanager-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/bloblifecyclemanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images/bloblifecyclemanager", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 bloblifecyclemanager 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /bloblifecyclemanager-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/bloblifecyclemanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images/bloblifecyclemanager", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/bloblifecyclemanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images/bloblifecyclemanager", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/bloblifecyclemanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images/bloblifecyclemanager", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/bloblifecyclemanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images/bloblifecyclemanager", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 bloblifecyclemanager 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /bloblifecyclemanager-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/bloblifecyclemanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images/bloblifecyclemanager", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/bloblifecyclemanager@sha256%3A08e8fc653c429a8b0042e5fdfec163f51541c7da6505b6fa9b2cc079f18d7922?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/catalog@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images/catalog", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 catalog 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /catalog-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/catalog@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images/catalog", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 catalog 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /catalog-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/catalog@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images/catalog", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/catalog@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images/catalog", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/catalog@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images/catalog", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/catalog@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images/catalog", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 catalog 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /catalog-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/catalog@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images/catalog", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/catalog@sha256%3Aa6b20821b7fb071f33fc7a48dc4c95603b12aee63308e29f80294a7024a682c5?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6303", "name": "GO-2026-6303", "description": "Source-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh", "aliases": [ "CVE-2026-56854" ] }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6354", "name": "GO-2026-6354", "description": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh", "aliases": [ "CVE-2026-78662" ] }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6355", "name": "GO-2026-6355", "description": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh", "aliases": [ "CVE-2026-56855" ] }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.54.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6603", "name": "GO-2026-6603", "description": "HTTP/2 server memory exhaustion due to Trailer headers in net/http", "aliases": [ "CVE-2026-78659" ] }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6610", "name": "GO-2026-6610", "description": "HTTP/2 transport accepts malformed framing-related headers in net/http", "aliases": [ "CVE-2026-78660" ] }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6611", "name": "GO-2026-6611", "description": "Excessive CPU consumption from repeated initial window changes in net/http", "aliases": [ "CVE-2026-78669" ] }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6612", "name": "GO-2026-6612", "description": "Double flow control refund on HTTP/2 server streams in net/http", "aliases": [ "CVE-2026-78663" ] }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6617", "name": "GO-2026-6617", "description": "HTTP/2 server crash due to HPACK encoder race in net/http", "aliases": [ "CVE-2026-97032" ] }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/net@v0.57.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6629", "name": "GO-2026-6629", "description": "Panic parsing crafted input in x/text/secure/precis in golang.org/x/text", "aliases": [ "CVE-2026-56851" ] }, "products": [ { "@id": "pkg:generic/configmap-reload@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/text@v0.40.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images/configmap-reload", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/text@v0.40.0" } ] }, { "@id": "pkg:oci/configmap-reload@sha256%3A3f8306174c78b2900aadf8b07e63fb0a94781818d57f5119054194d472cb1717?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/text@v0.40.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/controllermanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images/controllermanager", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 controllermanager 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /controllermanager-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/controllermanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images/controllermanager", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 controllermanager 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /controllermanager-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/controllermanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images/controllermanager", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/controllermanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images/controllermanager", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/controllermanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images/controllermanager", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/controllermanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images/controllermanager", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 controllermanager 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /controllermanager-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/controllermanager@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images/controllermanager", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/controllermanager@sha256%3A947f468b77eb2149e6d189824da6621cfec203c77b8a31f220e99e17ba6a1a8e?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/crypto@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images/crypto", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 crypto 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /crypto-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/crypto@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images/crypto", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 crypto 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /crypto-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/crypto@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images/crypto", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/crypto@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images/crypto", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/crypto@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images/crypto", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/crypto@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images/crypto", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 crypto 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /crypto-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/crypto@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images/crypto", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/crypto@sha256%3Aee27193353f662d98aeebd4c636a64fc5ec2b98cf321cdfd74ac19f34b792a2b?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/dashboardbff@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images/dashboardbff", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 dashboardbff 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /dashboardbff-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/dashboardbff@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images/dashboardbff", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 dashboardbff 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /dashboardbff-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/dashboardbff@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images/dashboardbff", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/dashboardbff@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images/dashboardbff", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/dashboardbff@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images/dashboardbff", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/dashboardbff@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images/dashboardbff", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 dashboardbff 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /dashboardbff-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6094", "name": "GO-2026-6094", "description": "JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go", "aliases": [ "GHSA-gcjh-h69q-9w9g" ] }, "products": [ { "@id": "pkg:generic/dashboardbff@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images/dashboardbff", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "govulncheck binary analysis of K10 dashboardbff 9.0.9 (pkg:golang/github.com/google/cel-go@v0.29.0): the vulnerable package is imported but no vulnerable function is called in /dashboardbff-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6107", "name": "GO-2026-6107", "description": "Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3", "aliases": [ "CVE-2026-73500", "GHSA-6vch-q96h-7gc3" ] }, "products": [ { "@id": "pkg:generic/dashboardbff@9.0.9", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images/dashboardbff", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 dashboardbff 9.0.9 (pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5): the vulnerable package is not imported in /dashboardbff-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/dashboardbff@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images/dashboardbff", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/dashboardbff@sha256%3Ac21b458e4402566863e49df8e178effe45ad47ff401afe00239eca152b8f5ed7?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/datamover@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images/datamover", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 datamover 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /opt/kasten/ceph/k10kopia, /opt/kasten/ceph/rbdChecker, /opt/kasten/datamover, /opt/kasten/dm, /opt/kasten/k10flr-vbr, /opt/kasten/k10kopia, /opt/kasten/vmbimporter, /opt/kasten/vmware/k10kopia, /opt/kasten/vmware/vmChecker." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/datamover@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images/datamover", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 datamover 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /opt/kasten/ceph/k10kopia, /opt/kasten/ceph/rbdChecker, /opt/kasten/datamover, /opt/kasten/dm, /opt/kasten/k10flr-vbr, /opt/kasten/k10kopia, /opt/kasten/vmbimporter, /opt/kasten/vmware/k10kopia, /opt/kasten/vmware/vmChecker." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/datamover@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images/datamover", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/datamover@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images/datamover", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/datamover@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images/datamover", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/datamover@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images/datamover", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 datamover 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /opt/kasten/ceph/k10kopia, /opt/kasten/ceph/rbdChecker, /opt/kasten/datamover, /opt/kasten/dm, /opt/kasten/k10flr-vbr, /opt/kasten/k10kopia, /opt/kasten/vmbimporter, /opt/kasten/vmware/k10kopia, /opt/kasten/vmware/vmChecker." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/datamover@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images/datamover", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/datamover@sha256%3A1e96d59ac70a153b9a5a248f880b296cd9789f5e72ae8d0cdc24ccda3499c221?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/dex@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images/dex", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/dex@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images/dex", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-2476", "name": "GO-2024-2476", "description": "Dex discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers in github.com/dexidp/dex", "aliases": [ "CVE-2024-23656", "GHSA-gr79-9v6v-gc9r" ] }, "products": [ { "@id": "pkg:generic/dex@9.0.9", "subcomponents": [ { "@id": "pkg:golang/./api/v2@(devel)" }, { "@id": "pkg:golang/github.com/dexidp/dex@v0.0.0-20260303133905-11d2eeb52b42+dirty" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images/dex", "subcomponents": [ { "@id": "pkg:golang/./api/v2@(devel)" }, { "@id": "pkg:golang/github.com/dexidp/dex@v0.0.0-20260303133905-11d2eeb52b42+dirty" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/./api/v2@(devel)" }, { "@id": "pkg:golang/github.com/dexidp/dex@v0.0.0-20260303133905-11d2eeb52b42+dirty" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/dex@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images/dex", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6107", "name": "GO-2026-6107", "description": "Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3", "aliases": [ "CVE-2026-73500", "GHSA-6vch-q96h-7gc3" ] }, "products": [ { "@id": "pkg:generic/dex@9.0.9", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.8" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images/dex", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.8" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.8" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6505", "name": "GO-2026-6505", "description": "OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace", "aliases": [ "CVE-2026-81870", "GHSA-8wmf-6v46-5gfg" ] }, "products": [ { "@id": "pkg:generic/dex@9.0.9", "subcomponents": [ { "@id": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.44.0" }, { "@id": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0" }, { "@id": "pkg:golang/go.opentelemetry.io/otel@v1.44.0" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images/dex", "subcomponents": [ { "@id": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.44.0" }, { "@id": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0" }, { "@id": "pkg:golang/go.opentelemetry.io/otel@v1.44.0" } ] }, { "@id": "pkg:oci/dex@sha256%3A554f41fe1611b4d531e4237f4021f6e0811d6ad6f845b32e7d26ca099a411c05?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/go.opentelemetry.io/otel/sdk/metric@v1.44.0" }, { "@id": "pkg:golang/go.opentelemetry.io/otel/sdk@v1.44.0" }, { "@id": "pkg:golang/go.opentelemetry.io/otel@v1.44.0" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/events@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images/events", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 events 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /events-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/events@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images/events", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 events 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /events-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/events@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images/events", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/events@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images/events", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/events@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images/events", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/events@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images/events", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 events 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /events-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/events@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images/events", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/events@sha256%3Abf023f60ad69d4210fde8dcce953ad23b872893dc7d0a6e6d822543a6cd21c9c?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/executor@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images/executor", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 executor 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /executor-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/executor@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images/executor", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 executor 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /executor-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/executor@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images/executor", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/executor@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images/executor", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/executor@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images/executor", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/executor@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images/executor", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 executor 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /executor-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6094", "name": "GO-2026-6094", "description": "JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go", "aliases": [ "GHSA-gcjh-h69q-9w9g" ] }, "products": [ { "@id": "pkg:generic/executor@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images/executor", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "govulncheck binary analysis of K10 executor 9.0.9 (pkg:golang/github.com/google/cel-go@v0.29.0): the vulnerable package is imported but no vulnerable function is called in /executor-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6107", "name": "GO-2026-6107", "description": "Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3", "aliases": [ "CVE-2026-73500", "GHSA-6vch-q96h-7gc3" ] }, "products": [ { "@id": "pkg:generic/executor@9.0.9", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images/executor", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 executor 9.0.9 (pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5): the vulnerable package is not imported in /executor-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/executor@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images/executor", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/executor@sha256%3A6530da49638536afd7731ee7d434673354cf48d8cad5281fb1d5502df1d4b4ec?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/frsession@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images/frsession", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 frsession 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /opt/kasten/ceph/k10kopia, /opt/kasten/ceph/rbdChecker, /opt/kasten/datamover, /opt/kasten/flrctl, /opt/kasten/k10flr-vbr, /opt/kasten/k10kopia, /opt/kasten/vmbimporter, /opt/kasten/vmware/k10kopia, /opt/kasten/vmware/vmChecker." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/frsession@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images/frsession", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 frsession 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /opt/kasten/ceph/k10kopia, /opt/kasten/ceph/rbdChecker, /opt/kasten/datamover, /opt/kasten/flrctl, /opt/kasten/k10flr-vbr, /opt/kasten/k10kopia, /opt/kasten/vmbimporter, /opt/kasten/vmware/k10kopia, /opt/kasten/vmware/vmChecker." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/frsession@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images/frsession", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/frsession@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images/frsession", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/frsession@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images/frsession", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/frsession@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images/frsession", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 frsession 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /opt/kasten/ceph/k10kopia, /opt/kasten/ceph/rbdChecker, /opt/kasten/datamover, /opt/kasten/flrctl, /opt/kasten/k10flr-vbr, /opt/kasten/k10kopia, /opt/kasten/vmbimporter, /opt/kasten/vmware/k10kopia, /opt/kasten/vmware/vmChecker." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/frsession@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images/frsession", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/frsession@sha256%3Afde99a2e1aa795b305565363d4d16ac0488af5407a4c187c3563edf6eea4b95f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/garbagecollector@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images/garbagecollector", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 garbagecollector 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /garbagecollector-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/garbagecollector@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images/garbagecollector", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 garbagecollector 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /garbagecollector-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/garbagecollector@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images/garbagecollector", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/garbagecollector@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images/garbagecollector", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/garbagecollector@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images/garbagecollector", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/garbagecollector@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images/garbagecollector", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 garbagecollector 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /garbagecollector-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/garbagecollector@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images/garbagecollector", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/garbagecollector@sha256%3Abcd50baf238dd38d7d8640adf2cc7e9a22cd1beb63d740ad10bbbeb4b1d4cc37?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/gateway@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/gateway@sha256%3A75609642e202c5b8d2af60b3eb8322d02b8cec90791731dbb6ce92a5633858f3?repository_url=gcr.io/kasten-images/gateway", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/gateway@sha256%3A75609642e202c5b8d2af60b3eb8322d02b8cec90791731dbb6ce92a5633858f3?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/jobs@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images/jobs", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 jobs 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /jobs-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/jobs@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images/jobs", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 jobs 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /jobs-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/jobs@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images/jobs", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/jobs@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images/jobs", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/jobs@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images/jobs", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/jobs@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images/jobs", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 jobs 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /jobs-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/jobs@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images/jobs", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/jobs@sha256%3A4a5720318866f525c572bd3bb23633f268cca2b6620de474c284c671f90e3854?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/k10fieldtools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/k10fieldtools@sha256%3A0756bc1640a89f5a3e80f2d279ba726866b76266943459322673f6c8de3e83e6?repository_url=gcr.io/kasten-images/k10fieldtools", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/k10fieldtools@sha256%3A0756bc1640a89f5a3e80f2d279ba726866b76266943459322673f6c8de3e83e6?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 k10fieldtools 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /k10fieldtools." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/k10fieldtools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/k10fieldtools@sha256%3A0756bc1640a89f5a3e80f2d279ba726866b76266943459322673f6c8de3e83e6?repository_url=gcr.io/kasten-images/k10fieldtools", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/k10fieldtools@sha256%3A0756bc1640a89f5a3e80f2d279ba726866b76266943459322673f6c8de3e83e6?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 k10fieldtools 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /k10fieldtools." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/k10fieldtools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/k10fieldtools@sha256%3A0756bc1640a89f5a3e80f2d279ba726866b76266943459322673f6c8de3e83e6?repository_url=gcr.io/kasten-images/k10fieldtools", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/k10fieldtools@sha256%3A0756bc1640a89f5a3e80f2d279ba726866b76266943459322673f6c8de3e83e6?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/k10fieldtools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/k10fieldtools@sha256%3A0756bc1640a89f5a3e80f2d279ba726866b76266943459322673f6c8de3e83e6?repository_url=gcr.io/kasten-images/k10fieldtools", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/k10fieldtools@sha256%3A0756bc1640a89f5a3e80f2d279ba726866b76266943459322673f6c8de3e83e6?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 k10fieldtools 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /k10fieldtools." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/k10tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images/k10tools", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 k10tools 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /k10tools." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/k10tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images/k10tools", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 k10tools 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /k10tools." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/k10tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images/k10tools", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/k10tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images/k10tools", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/k10tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images/k10tools", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/k10tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images/k10tools", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 k10tools 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /k10tools." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/k10tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images/k10tools", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/k10tools@sha256%3Ab25101b1074d81cb9462e217a7755f180c7fb8ce0ef49e594f44331de901b1a2?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/kanister@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images/kanister", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 kanister 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /controller." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/kanister@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images/kanister", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 kanister 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /controller." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/kanister@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images/kanister", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/kanister@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images/kanister", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/kanister@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images/kanister", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/kanister@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images/kanister", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 kanister 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /controller." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/kanister@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images/kanister", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/kanister@sha256%3A7dd36927f43182eeaf42699edbbc0586b11303f4713d509d3fa581cddd88af46?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/kanister-tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images/kanister-tools", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 kanister-tools 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /usr/local/bin/kando." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/kanister-tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images/kanister-tools", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 kanister-tools 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /usr/local/bin/kando." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/kanister-tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images/kanister-tools", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/kanister-tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images/kanister-tools", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/kanister-tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images/kanister-tools", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/kanister-tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images/kanister-tools", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 kanister-tools 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /usr/local/bin/kando, /usr/local/bin/kopia." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/kanister-tools@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images/kanister-tools", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/kanister-tools@sha256%3A3e34049e2acaf9c8c25ad6e6a6cd2e089d53800b00fc5294a653a4ad6d61d55f?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/logging@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images/logging", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 logging 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /logging-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/logging@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images/logging", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 logging 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /logging-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/logging@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images/logging", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/logging@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images/logging", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/logging@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images/logging", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/logging@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images/logging", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 logging 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /logging-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/logging@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images/logging", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/logging@sha256%3Ababdb000bd31680c42069d73489556976c87ebfe7dec59c861fc038da743b028?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/metering@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images/metering", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 metering 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /metering-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/metering@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images/metering", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 metering 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /metering-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/metering@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images/metering", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/metering@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images/metering", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/metering@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images/metering", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/metering@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images/metering", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 metering 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /metering-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/metering@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images/metering", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/metering@sha256%3Afc12c735507b85ac1ece559e72e0f8eae91895445fc2d406feec604fcdfd8e73?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/metric-sidecar@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/metric-sidecar@sha256%3A73f325fdef69c35a6f8b928e0d09a1477c7daf3ce7861c12f49002263ee7e0f6?repository_url=gcr.io/kasten-images/metric-sidecar", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/metric-sidecar@sha256%3A73f325fdef69c35a6f8b928e0d09a1477c7daf3ce7861c12f49002263ee7e0f6?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 metric-sidecar 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /metric-sidecar." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/metric-sidecar@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/metric-sidecar@sha256%3A73f325fdef69c35a6f8b928e0d09a1477c7daf3ce7861c12f49002263ee7e0f6?repository_url=gcr.io/kasten-images/metric-sidecar", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/metric-sidecar@sha256%3A73f325fdef69c35a6f8b928e0d09a1477c7daf3ce7861c12f49002263ee7e0f6?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 metric-sidecar 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /metric-sidecar." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/metric-sidecar@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/metric-sidecar@sha256%3A73f325fdef69c35a6f8b928e0d09a1477c7daf3ce7861c12f49002263ee7e0f6?repository_url=gcr.io/kasten-images/metric-sidecar", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/metric-sidecar@sha256%3A73f325fdef69c35a6f8b928e0d09a1477c7daf3ce7861c12f49002263ee7e0f6?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/metric-sidecar@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/metric-sidecar@sha256%3A73f325fdef69c35a6f8b928e0d09a1477c7daf3ce7861c12f49002263ee7e0f6?repository_url=gcr.io/kasten-images/metric-sidecar", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/metric-sidecar@sha256%3A73f325fdef69c35a6f8b928e0d09a1477c7daf3ce7861c12f49002263ee7e0f6?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 metric-sidecar 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /metric-sidecar." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/prometheus@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] }, { "@id": "pkg:oci/prometheus@sha256%3Ae9c0742d30e55dfac35b13af05691909c2bf4b177543d558652720ddba9da153?repository_url=gcr.io/kasten-images/prometheus", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] }, { "@id": "pkg:oci/prometheus@sha256%3Ae9c0742d30e55dfac35b13af05691909c2bf4b177543d558652720ddba9da153?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/prometheus@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] }, { "@id": "pkg:oci/prometheus@sha256%3Ae9c0742d30e55dfac35b13af05691909c2bf4b177543d558652720ddba9da153?repository_url=gcr.io/kasten-images/prometheus", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] }, { "@id": "pkg:oci/prometheus@sha256%3Ae9c0742d30e55dfac35b13af05691909c2bf4b177543d558652720ddba9da153?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.8" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/prometheus@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/prometheus@sha256%3Ae9c0742d30e55dfac35b13af05691909c2bf4b177543d558652720ddba9da153?repository_url=gcr.io/kasten-images/prometheus", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/prometheus@sha256%3Ae9c0742d30e55dfac35b13af05691909c2bf4b177543d558652720ddba9da153?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "under_investigation" }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/repositories@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images/repositories", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 repositories 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /repositories-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/repositories@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images/repositories", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 repositories 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /repositories-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/repositories@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images/repositories", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/repositories@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images/repositories", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/repositories@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images/repositories", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/repositories@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images/repositories", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 repositories 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /repositories-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/repositories@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images/repositories", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/repositories@sha256%3A93a1447d5670dd301ca90fce233b3ce7c2d65685dfb823041359443c1b0f098d?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/state@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images/state", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 state 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /state-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/state@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images/state", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 state 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /state-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/state@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images/state", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/state@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images/state", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/state@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images/state", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/state@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images/state", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 state 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /state-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/state@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images/state", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/state@sha256%3Ac96fe75e370a3ec67cc7a988f46d561be0c79811ccd9ecba90f90406ab3cc637?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0635", "name": "GO-2022-0635", "description": "In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8912", "GHSA-7f33-f4f5-xwgw" ] }, "products": [ { "@id": "pkg:generic/vbrintegrationapi@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images/vbrintegrationapi", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 vbrintegrationapi 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /vbrintegrationapi-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2022-0646", "name": "GO-2022-0646", "description": "CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go", "aliases": [ "CVE-2020-8911", "GHSA-f5pg-7wfw-84q9" ] }, "products": [ { "@id": "pkg:generic/vbrintegrationapi@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images/vbrintegrationapi", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/aws/aws-sdk-go@v1.55.7" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 vbrintegrationapi 9.0.9 (pkg:golang/github.com/aws/aws-sdk-go@v1.55.7): the vulnerable package is not imported in /vbrintegrationapi-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2024-3080", "name": "GO-2024-3080", "description": "Kanister vulnerable to cluster-level privilege escalation in github.com/kanisterio/kanister", "aliases": [ "CVE-2024-43403", "GHSA-h27c-6xm3-mcqp" ] }, "products": [ { "@id": "pkg:generic/vbrintegrationapi@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images/vbrintegrationapi", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kanisterio/kanister@v0.0.0-20261019100629-58c883080158" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3521", "name": "GO-2025-3521", "description": "Kubernetes GitRepo Volume Inadvertent Local Repository Access in k8s.io/kubernetes", "aliases": [ "CVE-2025-1767", "GHSA-3wgm-2gw2-vh5m" ] }, "products": [ { "@id": "pkg:generic/vbrintegrationapi@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images/vbrintegrationapi", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2025-3547", "name": "GO-2025-3547", "description": "Kubernetes kube-apiserver Vulnerable to Race Condition in k8s.io/kubernetes", "aliases": [ "CVE-2024-7598", "GHSA-r56h-j38w-hrqq" ] }, "products": [ { "@id": "pkg:generic/vbrintegrationapi@9.0.9", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images/vbrintegrationapi", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/k8s.io/kubernetes@v1.34.2" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-5932", "name": "GO-2026-5932", "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues" }, "products": [ { "@id": "pkg:generic/vbrintegrationapi@9.0.9", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images/vbrintegrationapi", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/golang.org/x/crypto@v0.57.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 vbrintegrationapi 9.0.9 (pkg:golang/golang.org/x/crypto@v0.57.0): the vulnerable package is not imported in /vbrintegrationapi-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6094", "name": "GO-2026-6094", "description": "JSON private fields exposed via NativeTypes and ParseStructTag in github.com/google/cel-go", "aliases": [ "GHSA-gcjh-h69q-9w9g" ] }, "products": [ { "@id": "pkg:generic/vbrintegrationapi@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images/vbrintegrationapi", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/google/cel-go@v0.29.0" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_in_execute_path", "impact_statement": "govulncheck binary analysis of K10 vbrintegrationapi 9.0.9 (pkg:golang/github.com/google/cel-go@v0.29.0): the vulnerable package is imported but no vulnerable function is called in /vbrintegrationapi-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6107", "name": "GO-2026-6107", "description": "Unbounded TLS handshake goroutines in go.etcd.io/etcd/client/pkg/v3", "aliases": [ "CVE-2026-73500", "GHSA-6vch-q96h-7gc3" ] }, "products": [ { "@id": "pkg:generic/vbrintegrationapi@9.0.9", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images/vbrintegrationapi", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5" } ] } ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "govulncheck binary analysis of K10 vbrintegrationapi 9.0.9 (pkg:golang/go.etcd.io/etcd/client/pkg/v3@v3.6.5): the vulnerable package is not imported in /vbrintegrationapi-server." }, { "vulnerability": { "@id": "https://pkg.go.dev/vuln/GO-2026-6142", "name": "GO-2026-6142", "description": "Logging operator has Fluentd configuration injection that allows remote code execution in github.com/kube-logging/logging-operator", "aliases": [ "CVE-2026-54680", "GHSA-mjqf-28ph-426h" ] }, "products": [ { "@id": "pkg:generic/vbrintegrationapi@9.0.9", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images/vbrintegrationapi", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] }, { "@id": "pkg:oci/vbrintegrationapi@sha256%3Ad86d993b4dd1667d156da1dacfb5e3e79d620dc4fb1883523029a2e9bfd88c20?repository_url=gcr.io/kasten-images", "subcomponents": [ { "@id": "pkg:golang/github.com/kube-logging/logging-operator/pkg/sdk@v0.12.0" }, { "@id": "pkg:golang/github.com/kube-logging/logging-operator@v0.0.0-20250424202944-7e1f9aad6e21" } ] } ], "status": "affected", "action_statement": "Under remediation; track the K10 release notes for the fix." } ] }