CVE-2022-1996

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.

CORS filters that use an AllowedDomains configuration parameter can match domains outside the specified set, permitting an attacker to avoid the CORS policy.

The AllowedDomains configuration parameter is documented as a list of allowed origin domains, but values in this list are applied as regular expression matches. For example, an allowed domain of "example.com" will match the Origin header "example.com.malicious.domain".

This update for trivy fixes the following issues:

trivy was updated to version 0.30.4:

• fix: remove the first arg when running as a plugin (#2595)
• fix: k8s controlplaner scanning (#2593)
• fix(vuln): GitLab report template (#2578)

Update to version 0.30.3:

• fix(server): use a new db worker for hot updates (#2581)
• docs: add trivy with download-db-only flag to Air-Gapped Environment (#2583)
• docs: split commands to download db for different versions of oras (#2582)
• feat(report): export exitcode for license checks (#2564)
• fix: cli can use lowercase for severities (#2565)
• fix: allow subcommands with TRIVY_RUN_AS_PLUGIN (#2577)
• fix: add missing types in TypeOSes and TypeLanguages in analyzer (#2569)
• fix: enable some features of the wasm runtime (#2575)
• fix(k8s): no error logged if trivy can't get docker image in kubernetes mode (#2521)
• docs(sbom): improve sbom attestation documentation (#2566)

Update to version 0.30.2:

• fix(report): show the summary without results (#2548)
• fix(cli): replace '-' to '_' for env vars (#2561)

Update to version 0.30.1:

• chore: remove a test repository (#2551)
• fix(license): lazy loading of classifiers (#2547)
• fix: CVE-2022-1996 in Trivy (#2499)
• docs(sbom): add sbom attestation (#2527)
• feat(rocky): set Rocky Linux 9 EOL (#2543)
• docs: add attributes to the video tag to autoplay demo videos (#2538)
• fix: yaml files with non-string chart name (#2534)
• fix: skip dirs (#2530)
• feat(repo): add support for branch, commit, & tag (#2494)
• fix: remove auto configure environment variables via viper (#2526)

Update to version 0.30.0:

• fix: separating multiple licenses from one line in dpkg copyright files (#2508)
• fix: change a capital letter for plugin uninstall subcommand (#2519)
• fix: k8s hide empty report when scanning resource (#2517)
• refactor: fix comments (#2516)
• fix: scan vendor dir (#2515)
• feat: Add support for license scanning (#2418)
• chore: add owners for secret scanning (#2485)
• fix: remove dependency-tree flag for image subcommand (#2492)
• fix(k8s): add shorthand for k8s namespace flag (#2495)
• docs: add information about using multiple servers to troubleshooting (#2498)
• ci: add pushing canary build images to registries (#2428)
• feat(dotnet): add support for .Net core .deps.json files (#2487)
• feat(amazon): add support for 2022 version (#2429)
• Type correction bitnami chart (#2415)
• docs: add config file and update CLI references (#2489)
• feat: add support for flag groups (#2488)
• refactor: move from urfave/cli to spf13/cobra (#2458)
• fix: Fix secrets output not containing file/lines (#2467)
• fix: clear output with modules (#2478)
• docs(cbl): distroless 1.0 supported (#2473)
• fix: Fix example dockerfile rego policy (#2460)
• fix(config): add helm to list of config analyzers (#2457)
• feat: k8s resouces scan (#2395)
• feat(sbom): add cyclonedx sbom scan (#2203)
• docs: remove links to removed content (#2431)
• ci: added rpm build for rhel 9 (#2437)
• fix(secret): remove space from asymmetric private key (#2434)
• test(integration): fix golden files for debian 9 (#2435)
• fix(cli): fix version string in docs link when secret scanning is enabled (#2422)
• refactor: move CycloneDX marshaling (#2420)
• docs(nodejs): add docs about pnpm support (#2423)
• docs: improve k8s usage documentation (#2425)
• feat: Make secrets scanning output consistant (#2410)
• ci: create canary build after main branch changes (#1638)
• fix(misconf): skip broken scans (#2396)
• feat(nodejs): add pnpm support (#2414)
• fix: Fix false positive for use of COS images (#2413)
• eliminate nerdctl dependency (#2412)
• Add EOL date for SUSE SLES 15.3, 15.4 and OpenSUSE 15.4 (#2403)
• fix(go): no cast to lowercase go package names (#2401)
• BREAKING(sbom): change 'trivy sbom' to scan SBOM (#2408)
• fix(server): hot update the db from custom repository (#2406)
• feat: added license parser for dpkg (#2381)
• fix(misconf): Update defsec (v0.68.5) to fix docker rego…

This update for trivy fixes the following issues:

Update to version 0.30.4:

• fix: remove the first arg when running as a plugin (#2595)
• fix: k8s controlplaner scanning (#2593)
• fix(vuln): GitLab report template (#2578)

Update to version 0.30.3:

• fix(server): use a new db worker for hot updates (#2581)
• docs: add trivy with download-db-only flag to Air-Gapped Environment (#2583)
• docs: split commands to download db for different versions of oras (#2582)
• feat(report): export exitcode for license checks (#2564)
• fix: cli can use lowercase for severities (#2565)
• fix: allow subcommands with TRIVY_RUN_AS_PLUGIN (#2577)
• fix: add missing types in TypeOSes and TypeLanguages in analyzer (#2569)
• fix: enable some features of the wasm runtime (#2575)
• fix(k8s): no error logged if trivy can't get docker image in kubernetes mode (#2521)
• docs(sbom): improve sbom attestation documentation (#2566)

Update to version 0.30.2:

• fix(report): show the summary without results (#2548)
• fix(cli): replace '-' to '_' for env vars (#2561)

Update to version 0.30.1:

• chore: remove a test repository (#2551)
• fix(license): lazy loading of classifiers (#2547)
• fix: CVE-2022-1996 in Trivy (#2499)
• docs(sbom): add sbom attestation (#2527)
• feat(rocky): set Rocky Linux 9 EOL (#2543)
• docs: add attributes to the video tag to autoplay demo videos (#2538)
• fix: yaml files with non-string chart name (#2534)
• fix: skip dirs (#2530)
• feat(repo): add support for branch, commit, & tag (#2494)
• fix: remove auto configure environment variables via viper (#2526)

Update to version 0.30.0:

• fix: separating multiple licenses from one line in dpkg copyright files (#2508)
• fix: change a capital letter for plugin uninstall subcommand (#2519)
• fix: k8s hide empty report when scanning resource (#2517)
• refactor: fix comments (#2516)
• fix: scan vendor dir (#2515)
• feat: Add support for license scanning (#2418)
• chore: add owners for secret scanning (#2485)
• fix: remove dependency-tree flag for image subcommand (#2492)
• fix(k8s): add shorthand for k8s namespace flag (#2495)
• docs: add information about using multiple servers to troubleshooting (#2498)
• ci: add pushing canary build images to registries (#2428)
• feat(dotnet): add support for .Net core .deps.json files (#2487)
• feat(amazon): add support for 2022 version (#2429)
• Type correction bitnami chart (#2415)
• docs: add config file and update CLI references (#2489)
• feat: add support for flag groups (#2488)
• refactor: move from urfave/cli to spf13/cobra (#2458)
• fix: Fix secrets output not containing file/lines (#2467)
• fix: clear output with modules (#2478)
• docs(cbl): distroless 1.0 supported (#2473)
• fix: Fix example dockerfile rego policy (#2460)
• fix(config): add helm to list of config analyzers (#2457)
• feat: k8s resouces scan (#2395)
• feat(sbom): add cyclonedx sbom scan (#2203)
• docs: remove links to removed content (#2431)
• ci: added rpm build for rhel 9 (#2437)
• fix(secret): remove space from asymmetric private key (#2434)
• test(integration): fix golden files for debian 9 (#2435)
• fix(cli): fix version string in docs link when secret scanning is enabled (#2422)
• refactor: move CycloneDX marshaling (#2420)
• docs(nodejs): add docs about pnpm support (#2423)
• docs: improve k8s usage documentation (#2425)
• feat: Make secrets scanning output consistant (#2410)
• ci: create canary build after main branch changes (#1638)
• fix(misconf): skip broken scans (#2396)
• feat(nodejs): add pnpm support (#2414)
• fix: Fix false positive for use of COS images (#2413)
• eliminate nerdctl dependency (#2412)
• Add EOL date for SUSE SLES 15.3, 15.4 and OpenSUSE 15.4 (#2403)
• fix(go): no cast to lowercase go package names (#2401)
• BREAKING(sbom): change 'trivy sbom' to scan SBOM (#2408)
• fix(server): hot update the db from custom repository (#2406)
• feat: added license parser for dpkg (#2381)
• fix(misconf): Update defsec (v0.68.5) to fix docker rego duplicate…

These are all security issues fixed in the trivy-0.30.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm-3.9.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the containerd-1.7.17-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.

This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues:

Security issues fixed:

• CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516)

Security issues fixed in vendored dependencies:

• CVE-2022-1996: Fixed go-restful CORS bypass (bsc#1200528)
• CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration (bsc#1199460)

Other fixes:

• Pack nft rules and nsswitch.conf for virt-handler
• Only create 1MiB-aligned disk images (bsc#1199603)
• Avoid to return nil failure message
• Use semantic equality comparison
• Allow to configure utility containers for update test
• Install nftables to manage network rules
• Install tar to allow kubectl cp ...
• Symlink nsswitch.conf and nft rules to proper locations
• Enable USB redirection support for QEMU
• Install vim-small instread of vim
• Drop libvirt-daemon-driver-storage-core
• Install ethtool and gawk (bsc#1199392)
• Use non-versioned appliance to avoid redundant rpm query
• Explicitly state the dependency on kubevirt main package

This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues:

The kubevirt stack was updated to version 0.54.0

Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0

Security fixes:

• CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516)

Security fixes in vendored dependencies:

• CVE-2022-1996: Fixed go-restful CORS bypass bsc#1200528)

• CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration (bsc#1199460)

• Fix containerdisk unmount logic

• Support topology spread constraints

• Update libvirt-go to fix memory leak

• Pack nft rules and nsswitch.conf for virt-handler

• Only create 1MiB-aligned disk images (bsc#1199603)

• Avoid to return nil failure message

• Use semantic equality comparison

• Drop kubevirt-psp-caasp.yaml

• Allow to configure utility containers for update test

• Symlink nsswitch.conf and nft rules to proper locations

• Drop unused package libvirt-client

• Install vim-small instead of vim

• Remove unneeded libvirt-daemon-driver-storage-core

• Install missing packages ethtool and gawk. Fixes bsc#1199392

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues:

Update to version 1.51.0

• Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0

Security issues fixed in vendored dependencies:

• CVE-2022-1996: Fixed CORS bypass (bsc#1200528)

• Include additional tools used by cdi-importer: cdi-containerimage-server cdi-image-size-detection cdi-source-update-poller

• Pack only cdi-operator and cdi-cr release manifests

• Install tar for cloning filesystem PVCs

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues:

Update to version 1.43.2

• Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.2

Security issues fixed:

• CVE-2022-1996: Fixed CORS bypass in go-restful vendored dependency (bsc#1200528)

Other fixes:

• Include additional tools used by cdi-importer: cdi-containerimage-server cdi-source-update-poller
• Pack only cdi-{cr,operator}.yaml into the manifests RPM
• Install tar package (used for cloning filesystem PVCs)

This update for helm fixes the following issues:

helm was updated to version 3.9.4:

• CVE-2022-36055: Fixed denial of service through string value parsing (bsc#1203054).
• Updating the certificates used for testing
• Updating index handling

helm was updated to version 3.9.3:

• CVE-2022-1996: Updated kube-openapi to fix an issue that could result in a CORS protection bypass (bsc#1200528).

• Fix missing array length check on release

helm was updated to version 3.9.2:

• Update of the circleci image

helm was updated to version 3.9.1:

• Update to support Kubernetes 1.24.2
• Improve logging and safety of statefulSetReady
• Make token caching an opt-in feature
• Bump github.com/lib/pq from 1.10.5 to 1.10.6
• Bump github.com/Masterminds/squirrel from 1.5.2 to 1.5.3

helm was updated to version 3.9.0:

• Added a --quiet flag to helm lint
• Added a --post-renderer-args flag to support arguments being passed to the post renderer
• Added more checks during the signing process
• Updated to add Kubernetes 1.24 support

helm was updated to version 3.8.2:

• Bump oras.land/oras-go from 1.1.0 to 1.1.1
• Fixing downloader plugin error handling
• Simplify testdata charts
• Simplify testdata charts
• Add tests for multi-level dependencies.
• Fix value precedence
• Bumping Kubernetes package versions
• Updating vcs to latest version
• Dont modify provided transport
• Pass http getter as pointer in tests
• Add docs block
• Add transport option and tests
• Reuse http transport
• Updating Kubernetes libs to 0.23.4 (latest)
• fix: remove deadcode
• fix: helm package tests
• fix: helm package with dependency update for charts with OCI dependencies
• Fix typo Unset the env var before func return in Unit Test
• add legal name check
• maint: fix syntax error in deploy.sh
• linting issue fixed
• only apply overwrite if version is canary
• overwrite flag added to az storage blob upload-batch
• Avoid querying for OCI tags can explicit version provided in chart dependencies
• Management of bearer tokens for tag listing
• Updating Kubernetes packages to 1.23.3
• refactor: use os.ReadDir for lightweight directory reading
• Add IngressClass to manifests to be (un)installed
• feat(comp): Shell completion for OCI
• Fix install memory/goroutine leak

This update for helm fixes the following issues:

Update to version 3.10.3:

• CVE-2022-23524: Fixed a denial of service in the string value parsing (bsc#1206467).
• CVE-2022-23525: Fixed a denial of service with the repository index file (bsc#1206469).
• CVE-2022-23526: Fixed a denial of service in the schema file handling (bsc#1206471).

This update of runc and containerd fixes the following issues:

containerd:

• Update to containerd v1.7.8. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.8

  • CVE-2022-1996: Fixed CORS bypass in go-restful (bsc#1200528)

catatonit:

• Update to catatonit v0.2.0.

  • Change license to GPL-2.0-or-later.

• Update to catatont v0.1.7

  • This release adds the ability for catatonit to be used as the only process in a pause container, by passing the -P flag (in this mode no subprocess is spawned and thus no signal forwarding is done).

• Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to socket activation or features somewhat adjacent to socket activation (such as passing file descriptors).

runc:

• Update to runc v1.1.10. Upstream changelog is available from https://github.com/opencontainers/runc/releases/tag/v1.1.10

This update for containerd fixes the following issues:

• CVE-2022-1996: Fixed CORS bypass (bsc#1200528).

This update for containerd fixes the following issues:

• Update to containerd v1.7.21
• CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics. (bsc#1217070)
• CVE-2023-45142: Fixed DoS vulnerability in otelhttp. (bsc#1228553)

This update for aws-iam-authenticator fixes the following issues:

• CVE-2022-1996: Fixed CORS bypass (bsc#1200528).

This update for containerd fixes the following issues:

• Update to containerd v1.7.21. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.21 Fixes CVE-2023-47108. bsc#1217070 Fixes CVE-2023-45142. bsc#1228553

• Update to containerd v1.7.17. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.17

• Update to containerd v1.7.16. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.16 CVE-2023-45288 bsc#1221400

• Update to containerd v1.7.15. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.15

• Update to containerd v1.7.14. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.14

• Update to containerd v1.7.13. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.13

• Update to containerd v1.7.12. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.12

• Update to containerd v1.7.11. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.11 GHSA-jq35-85cj-fj4p bsc#1224323

This update for aws-iam-authenticator fixes the following issues

• CVE-2022-1996: CORS bypass (bsc#1200528).
• CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass (bsc#1201395).
• CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store.
• CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad.
• CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265842).
• CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266651).

Changes for aws-iam-authenticator:

• Update to version 0.7.18

• Merge pull request (#1062) from CaidenBorrego/new-release
• Creating new release for CVE mitigation
• Merge pull request (#1057) from CaidenBorrego/caidenb-versionbump
• Merge remote-tracking branch 'upstream/master' into caidenb-versionbump
• Bump x/net and x/sys to remediate CVEs (bsc#1266651, CVE-2026-39821)

• Update to 0.7.17

• Merge pull request #1051 from CaidenBorrego/caidenb-versionbump
• bumping version from 0.7.16->0.7.17
• Merge pull request #1047 from CaidenBorrego/caidenb-reservedprefix-fix
• fix: honor reservedPrefixConfig for ConfigMap and CRD backends
• Merge pull request #1046 from CaidenBorrego/caidenb-gorunner-bump
• fix: reject malformed mapping ARN in userIDStrict mode for dynamic files

• Update to 0.7.16

• Merge pull request #1041 from ronaldngounou/rngounou/bump-go-1.26.3
• Pin GitHub Actions to full-length commit SHAs
• fix: bump go version to 1.26.3 for CVEs

• from version 0.7.15

• Merge pull request #1035 from Ganiredi/bump-version-0.7.15
• Bump version to 0.7.15
• Merge pull request #1030 from Ganiredi/1.36-k8s-deps
• 1.36.0 dependency update

• from version 0.7.14

• Merge pull request #1029 from CaidenBorrego/caidenb-gorunner-bump
• Bump version to 0.7.14
• Bumping gorunner image tag in Dockerfile for CVE mitigation

• from version 0.7.13

• Merge pull request #1020 from dheeraj-coding/master
• feat: add manual dispatch function for create-release.yml
• Merge pull request #1019 from dheeraj-coding/master
• fix: create-release workflow failures
• Merge pull request #1017 from Ganiredi/1.36-k8s-deps
• Merge pull request #1018 from dheeraj-coding/master
• fix: build failure due to stale gcb image by updating to latest
• Release 0.7.13
• Merge pull request #1016 from Ganiredi/1.36-k8s-deps
• Merge branch 'master' into 1.36-k8s-deps
• Merge pull request #1013 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-be00ae3611
• 1.36.rc release
• Merge pull request #1015 from dheeraj-coding/master
• fix: bump go version 1.26.2 for CVEs
• chore(deps): Bump the misc-dependencies group across 3 directories with 6 updates (bsc#1265842, CVE-2026-33814)
• Merge pull request #1011 from kubernetes-sigs/dependabot/go_modules/observability-dependencies-9e34dd3c34
• Merge pull request #1009 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-b5e1eeb2d5
• Merge pull request #1004 from bryantbiggs/chore/fix-goreleaser-deprecations
• Merge pull request #1010 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-7118f1d525
• chore(deps): Bump the observability-dependencies group across 2 directories with 2 updates
• chore(deps): Bump the aws-dependencies group across 2 directories with 6 updates
• chore(deps): Bump the misc-dependencies group across 3 directories with 2 updates
• Merge pull request #1008 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-3ce7b5fcac
• chore(deps): Bump the aws-dependencies group across 2 directories with 12 updates
• Merge pull request #1006 from kubernetes-sigs/dependabot/go_modules/k8s-dependencies-09346e948b
• chore(deps): Bump the k8s-dependencies group across 3 directories with 8 updates
• Merge pull request #1005 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-508cd0fd8e
• chore(deps):…