{"id":"CVE-2022-1996","aliases":["ALPINE-CVE-2022-1996","AZL-41344","DEBIAN-CVE-2022-1996","EUVD-2022-6141","GHSA-r48q-9g5r-8q2h","GO-2022-0619","RHSA-2022:6042","RHSA-2023:3229","RHSA-2023:3557","SUSE-SU-2022:3321-1","SUSE-SU-2022:3333-1","SUSE-SU-2022:3334-1","SUSE-SU-2022:3335-1","SUSE-SU-2022:3666-1","SUSE-SU-2022:4606-1","SUSE-SU-2023:4727-1","SUSE-SU-2024:0799-1","SUSE-SU-2024:3221-1","SUSE-SU-2024:4329-1","SUSE-SU-2025:20091-1","SUSE-SU-2026:2643-1","UBUNTU-CVE-2022-1996","openSUSE-SU-2022:10081-1","openSUSE-SU-2022:10094-1","openSUSE-SU-2024:12205-1","openSUSE-SU-2024:12252-1","openSUSE-SU-2024:14081-1","openSUSE-SU-2025:15779-1"],"status":"published","title":"Authorization Bypass Through User-Controlled Key in emicklei/go-restful","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","severity":{"version":"3.0","score":9.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.03115,"percentile":0.87898,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639"],"published":"2022-06-06T00:00:00Z","modified":"2026-11-03T08:00:32Z","fixes":[{"ecosystem":"Go","package":"github.com/emicklei/go-restful/v3","fixed_in":["3.8.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/emicklei/go-restful","fixed_in":["2.16.0","2.16.0+incompatible"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.18","package":"gitlab-runner","fixed_in":["15.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"gitlab-runner","fixed_in":["15.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"gitlab-runner","fixed_in":["15.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"gitlab-runner","fixed_in":["15.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"gitlab-runner","fixed_in":["15.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"gitlab-runner","fixed_in":["15.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"gitlab-runner","fixed_in":["15.10.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"sriov-network-device-plugin","fixed_in":["3.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"golang-github-emicklei-go-restful","fixed_in":["3.10.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-emicklei-go-restful","fixed_in":["3.10.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-emicklei-go-restful","fixed_in":["3.10.2-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift_gitops:1.8::el8","package":"openshift-gitops-kam","fixed_in":["0:1.8.3-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift_gitops:1.8::el8","package":"openshift-gitops-kam-redistributable","fixed_in":["0:1.8.3-6.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift_gitops:1.9::el9","package":"openshift-gitops-kam","fixed_in":["0:1.9.0-102.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift_gitops:1.9::el9","package":"openshift-gitops-kam-redistributable","fixed_in":["0:1.9.0-102.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"containerized-data-importer","fixed_in":["1.51.0-150400.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"containerized-data-importer","fixed_in":["1.51.0-150400.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"containerized-data-importer","fixed_in":["1.43.2-150300.8.9.3"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"containerized-data-importer","fixed_in":["1.43.2-150300.8.9.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"catatonit","fixed_in":["0.2.0-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"catatonit","fixed_in":["0.2.0-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"catatonit","fixed_in":["0.2.0-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"catatonit","fixed_in":["0.2.0-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"catatonit","fixed_in":["0.2.0-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"catatonit","fixed_in":["0.2.0-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.3","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap Micro 5.4","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"containerd","fixed_in":["1.7.8-150000.103.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"runc","fixed_in":["1.1.10-150000.55.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","fixed_in":["1.7.8-16.91.7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"aws-iam-authenticator","fixed_in":["0.5.3-150000.1.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"trivy","fixed_in":["0.30.4-bp154.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"trivy","fixed_in":["0.30.4-bp154.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"trivy","fixed_in":["0.30.2-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"helm","fixed_in":["3.9.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"containerd","fixed_in":["1.7.17-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/emicklei/go-restful/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.8.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/emicklei/go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/emicklei/go-restful/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.7.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"gitlab-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"gitlab-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"gitlab-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"gitlab-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"gitlab-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"gitlab-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"gitlab-runner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.10.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"sriov-network-device-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.2-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/emicklei/go-restful/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.8.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/emicklei/go-restful","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.16.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/emicklei/go-restful/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.7.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/emicklei/go-restful","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.16.0+incompatible"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/emicklei/go-restful/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.7.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/emicklei/go-restful/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.8.0"}]}]},{"source":"osv","ecosystem":"Red Hat:serverless:1.0::el8","package":"openshift-serverless-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.1-4.el8"}]}],"bundled":15},{"source":"osv","ecosystem":"Red Hat:openshift_gitops:1.8::el8","package":"openshift-gitops-kam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift_gitops:1.8::el8","package":"openshift-gitops-kam-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.3-6.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift_gitops:1.9::el9","package":"openshift-gitops-kam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-102.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift_gitops:1.9::el9","package":"openshift-gitops-kam-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-102.el8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49.0-150300.8.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.49.0-150300.8.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.54.0-150400.3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"kubevirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.54.0-150400.3.3.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.0-150400.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.51.0-150400.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.2-150300.8.9.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"containerized-data-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.2-150300.8.9.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP3","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150000.1.10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150000.1.10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150000.1.10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150000.1.10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150000.1.10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-150000.1.10.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-150000.1.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-150000.1.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-150000.1.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-150000.1.13.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP4","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.0-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-150000.103.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10-150000.55.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-16.91.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP6","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-150000.117.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-150000.1.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.21-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-150000.1.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-150000.1.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-150000.1.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"aws-iam-authenticator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.18-150000.1.17.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.3-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-1","2.4.0-1","2.4.0-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0-2","2.11.1-1","2.11.1-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.1-2","3.7.3-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-emicklei-go-restful","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.2-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.4-bp154.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.4-bp154.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.4-bp153.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.4-bp153.8.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"trivy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.2-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.17-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"helm3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.2-1.1"}]}],"bundled":20}],"products":[{"vendor":"emicklei","product":"emicklei/go-restful"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"go-restful_project","product":"go-restful"}],"references":[{"url":"https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1","tags":["x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220923-0005/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1996","tags":["web","advisory"]},{"url":"https://github.com/emicklei/go-restful/issues/489","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/"},{"url":"https://github.com/emicklei/go-restful/commit/926662532deb450272956c7bc573978464aae74e","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/"},{"url":"https://github.com/emicklei/go-restful/commit/f292efff46ae17e9d104f865a60a39a2ae9402f1","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0619","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS/"},{"url":"https://github.com/advisories/GHSA-r48q-9g5r-8q2h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-1996","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1996.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-1996","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220923-0005","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGQKWD6SE75PFBPFVSZYAKAVXKBZXKWS","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W56PP46JVZEKCANBKXFKRVSBBRRMCY6V","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SO5QC2JFW2PXBWAE27OYYYL5SPFUBHTY","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3","tags":["web"]},{"url":"https://github.com/emicklei/go-restful","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6042","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.6/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.7/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.8/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.9/html/serverless/index","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/openshift_container_platform/4.10/html/serverless/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2045880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2064857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2077689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2092793","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2094982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107392","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108527","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6042.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1705","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1705","tags":["advisory"]},{"url":"https://go.dev/issue/53188","tags":["article"]},{"url":"https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1962","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1962","tags":["advisory"]},{"url":"https://go.dev/issue/53616","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1996","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1996","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21698","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21698","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21698","tags":["advisory"]},{"url":"https://github.com/prometheus/client_golang/security/advisories/GHSA-cg3q-j54f-5p7p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24675","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24675","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/oecdBNLOml8","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-24921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-24921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24921","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/RP1hfrBYVuk","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28131","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28131","tags":["advisory"]},{"url":"https://go.dev/issue/53614","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-28327","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28327","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28327","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30629","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30629","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30629","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/TzIC9-t8Ytg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30630","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30630","tags":["advisory"]},{"url":"https://go.dev/issue/53415","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30631","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30631","tags":["advisory"]},{"url":"https://go.dev/issue/53168","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30632","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30632","tags":["advisory"]},{"url":"https://go.dev/issue/53416","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30633","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30633","tags":["advisory"]},{"url":"https://go.dev/issue/53611","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-30635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-30635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-30635","tags":["advisory"]},{"url":"https://go.dev/issue/53615","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-32148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-32148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-32148","tags":["advisory"]},{"url":"https://go.dev/issue/53423","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3229","tags":["advisory"]},{"url":"https://docs.openshift.com/container-platform/latest/cicd/gitops/understanding-openshift-gitops.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3229.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:3557","tags":["advisory"]},{"url":"https://docs.openshift.com/container-platform/latest/cicd/gitops/gitops-release-notes.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3557.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223321-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199392","tags":["report"]},{"url":"https://bugzilla.suse.com/1199460","tags":["report"]},{"url":"https://bugzilla.suse.com/1199603","tags":["report"]},{"url":"https://bugzilla.suse.com/1200528","tags":["report"]},{"url":"https://bugzilla.suse.com/1202516","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29162","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223333-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223334-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223335-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223666-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203054","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-36055","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224606-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181419","tags":["report"]},{"url":"https://bugzilla.suse.com/1206467","tags":["report"]},{"url":"https://bugzilla.suse.com/1206469","tags":["report"]},{"url":"https://bugzilla.suse.com/1206471","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23526","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234727-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20240799-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243221-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1217070","tags":["report"]},{"url":"https://bugzilla.suse.com/1228553","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47108","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244329-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520091-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1221400","tags":["report"]},{"url":"https://bugzilla.suse.com/1224323","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45288","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262643-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201395","tags":["report"]},{"url":"https://bugzilla.suse.com/1227519","tags":["report"]},{"url":"https://bugzilla.suse.com/1239947","tags":["report"]},{"url":"https://bugzilla.suse.com/1249141","tags":["report"]},{"url":"https://bugzilla.suse.com/1265842","tags":["report"]},{"url":"https://bugzilla.suse.com/1266651","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-39821","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-1996","tags":["report"]},{"url":"https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1/","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5HVVWQ7QWDT7GBZUAYXIWYZURAWKCEVQ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TFXT5GO737TPBRXIUOZS7A3WOJKWSJAX/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199760","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-28946","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-25173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-25620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26147","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45337","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-22872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58190","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-1996","title":"Authorization Bypass Through User-Controlled Key in emicklei/go-restful","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-06T00:00:00Z","modified":"2024-08-03T00:24:43.677Z","cvss":[{"version":"3.0","score":9.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:34:38.263045Z"}],"euvd":[{"id":"EUVD-2022-6141","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-06T00:00:00Z","modified":"2024-08-03T00:24:43Z","cvss":[{"version":"3.0","score":9.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T03:25:59.498764Z"}],"ghsa":[{"id":"GHSA-r48q-9g5r-8q2h","title":"Authorization Bypass Through User-Controlled Key in go-restful","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-09T00:00:23Z","modified":"2023-03-01T18:32:20Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"nvd":[{"id":"CVE-2022-1996","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-08T13:15:07.987Z","modified":"2026-06-17T04:23:29.38Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.0","score":9.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:07:21.62951Z"}],"osv":[{"id":"ALPINE-CVE-2022-1996","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-08T13:15:07.987Z","modified":"2026-11-03T07:30:16.503013982Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-41344","title":"CVE-2022-1996 affecting package sriov-network-device-plugin for versions less than 3.7.0-1","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-08T13:15:07Z","modified":"2026-04-21T04:51:22.646103Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CVE-2022-1996","title":"Authorization Bypass Through User-Controlled Key in emicklei/go-restful","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-06T00:00:00Z","modified":"2026-10-28T02:30:23.376083141Z","cvss":[{"version":"3.0","score":9.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-1996","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-08T13:15:07.987Z","modified":"2026-11-03T08:00:32.976519791Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"GHSA-r48q-9g5r-8q2h","title":"Authorization Bypass Through User-Controlled Key in go-restful","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-09T00:00:23Z","modified":"2026-09-10T03:49:49.375009032Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"RHSA-2022:6042","title":"Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.24.0","status":"published","published":"2024-09-30T14:23:13Z","modified":"2026-10-20T10:01:26Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RHSA-2023:3229","title":"Red Hat Security Advisory: openshift-gitops-kam security update","status":"published","published":"2024-09-16T08:37:47Z","modified":"2026-08-05T10:14:47Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"RHSA-2023:3557","title":"Red Hat Security Advisory: openshift-gitops-kam security update","status":"published","published":"2024-09-16T08:37:57Z","modified":"2026-08-05T10:15:02Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:53:11.154197Z"},{"id":"UBUNTU-CVE-2022-1996","description":"Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0.","status":"published","published":"2022-06-08T13:15:00Z","modified":"2026-10-17T12:55:56.387487422Z","cvss":[{"version":"3.0","score":9.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"GO-2022-0619","title":"Authorization bypass in github.com/emicklei/go-restful, go-restful/v2 and go-restful/v3","description":"CORS filters that use an AllowedDomains configuration parameter can match domains outside the specified set, permitting an attacker to avoid the CORS policy.\n\nThe AllowedDomains configuration parameter is documented as a list of allowed origin domains, but values in this list are applied as regular expression matches. For example, an allowed domain of \"example.com\" will match the Origin header \"example.com.malicious.domain\".","status":"published","published":"2022-08-15T18:05:29Z","modified":"2026-02-04T02:45:38.113647Z","updated_at":"2026-11-02T15:47:00.918515Z"},{"id":"openSUSE-SU-2022:10081-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\ntrivy was updated to version 0.30.4:\n\n* fix: remove the first arg when running as a plugin (#2595)\n* fix: k8s controlplaner scanning (#2593)\n* fix(vuln): GitLab report template (#2578)\n\nUpdate to version 0.30.3:\n\n* fix(server): use a new db worker for hot updates (#2581)\n* docs: add trivy with download-db-only flag to Air-Gapped Environment (#2583)\n* docs: split commands to download db for different versions of oras (#2582)\n* feat(report): export exitcode for license checks (#2564)\n* fix: cli can use lowercase for severities (#2565)\n* fix: allow subcommands with TRIVY_RUN_AS_PLUGIN (#2577)\n* fix: add missing types in TypeOSes and TypeLanguages in analyzer (#2569)\n* fix: enable some features of the wasm runtime (#2575)\n* fix(k8s): no error logged if trivy can't get docker image in kubernetes mode (#2521)\n* docs(sbom): improve sbom attestation documentation (#2566)\n\nUpdate to version 0.30.2:\n\n* fix(report): show the summary without results (#2548)\n* fix(cli): replace '-' to '_' for env vars (#2561)\n\nUpdate to version 0.30.1:\n\n* chore: remove a test repository (#2551)\n* fix(license): lazy loading of classifiers (#2547)\n* fix: CVE-2022-1996 in Trivy (#2499)\n* docs(sbom): add sbom attestation (#2527)\n* feat(rocky): set Rocky Linux 9 EOL (#2543)\n* docs: add attributes to the video tag to autoplay demo videos (#2538)\n* fix: yaml files with non-string chart name (#2534)\n* fix: skip dirs (#2530)\n* feat(repo): add support for branch, commit, \u0026 tag (#2494)\n* fix: remove auto configure environment variables via viper (#2526)\n\nUpdate to version 0.30.0:\n\n* fix: separating multiple licenses from one line in dpkg copyright files (#2508)\n* fix: change a capital letter for `plugin uninstall` subcommand (#2519)\n* fix: k8s hide empty report when scanning resource (#2517)\n* refactor: fix comments (#2516)\n* fix: scan vendor dir (#2515)\n* feat: Add support for license scanning (#2418)\n* chore: add owners for secret scanning (#2485)\n* fix: remove dependency-tree flag for image subcommand (#2492)\n* fix(k8s): add shorthand for k8s namespace flag (#2495)\n* docs: add information about using multiple servers to troubleshooting (#2498)\n* ci: add pushing canary build images to registries (#2428)\n* feat(dotnet): add support for .Net core .deps.json files (#2487)\n* feat(amazon): add support for 2022 version (#2429)\n* Type correction bitnami chart (#2415)\n* docs: add config file and update CLI references (#2489)\n* feat: add support for flag groups (#2488)\n* refactor: move from urfave/cli to spf13/cobra (#2458)\n* fix: Fix secrets output not containing file/lines (#2467)\n* fix: clear output with modules (#2478)\n* docs(cbl): distroless 1.0 supported (#2473)\n* fix: Fix example dockerfile rego policy (#2460)\n* fix(config): add helm to list of config analyzers (#2457)\n* feat: k8s resouces scan (#2395)\n* feat(sbom): add cyclonedx sbom scan (#2203)\n* docs: remove links to removed content (#2431)\n* ci: added rpm build for rhel 9 (#2437)\n* fix(secret): remove space from asymmetric private key (#2434)\n* test(integration): fix golden files for debian 9 (#2435)\n* fix(cli): fix version string in docs link when secret scanning is enabled (#2422)\n* refactor: move CycloneDX marshaling (#2420)\n* docs(nodejs): add docs about pnpm support (#2423)\n* docs: improve k8s usage documentation (#2425)\n* feat: Make secrets scanning output consistant (#2410)\n* ci: create canary build after main branch changes  (#1638)\n* fix(misconf): skip broken scans (#2396)\n* feat(nodejs): add pnpm support (#2414)\n* fix: Fix false positive for use of COS images (#2413)\n* eliminate nerdctl dependency (#2412)\n* Add EOL date for SUSE SLES 15.3, 15.4 and OpenSUSE 15.4 (#2403)\n* fix(go): no cast to lowercase go package names (#2401)\n* BREAKING(sbom): change 'trivy sbom' to scan SBOM (#2408)\n* fix(server): hot update the db from custom repository (#2406)\n* feat: added license parser for dpkg (#2381)\n* fix(misconf): Update defsec (v0.68.5) to fix docker rego duplicate key (#2400)\n* feat: extract stripe publishable and secret keys (#2392)\n* feat: rbac support k8s sub-command (#2339)\n* feat(ruby): drop platform strings from dependency versions bundled with bundler v2 (#2390)\n* docs: Updating README with new CLI command (#2359)\n* fix(misconf): Update defsec to v0.68.4 to resolve CF detection bug (#2383)\n* chore: add integration label and merge security label (#2316)\n\nUpdate to version 0.29.2:\n\n* chore: skip Visual Studio Code project folder (#2379)\n* fix(helm): handle charts with templated names (#2374)\n* docs: redirect operator docs to trivy-operator repo (#2372)\n* fix(secret): use secret result when determining Failed status (#2370)\n* try removing libdb-dev\n* run integration tests in fanal\n* use same testing images in fanal\n* feat(helm): add support for trivy dbRepository (#2345)\n* fix: Fix failing test due to deref lint issue\n* test: Fix broken test\n* fix: Fix makefile when no previous named ref is visible in a shallow clone\n* chore: Fix linting issues in fanal\n* refactor: Fix fanal import paths and remove dotfiles\n\nUpdate to version 0.29.1:\n\n* fix(report): add required fields to the SARIF template (#2341)\n* chore: fix spelling errors (#2352)\n* Omit Remediation if PrimaryURL is empty (#2006)\n* docs(repo): Link to installation documentation in readme shows 404 (#2348)\n* feat(alma): support for scanning of modular packages for AlmaLinux (#2347)\n\nUpdate to version 0.29.0:\n\n* fix(lang): fix dependency graph in client server mode (#2336)\n* feat: allow expiration date for .trivyignore entries (#2332)\n* feat(lang): add dependency origin graph (#1970)\n* docs: update nix installation info (#2331)\n* feat: add rbac scanning support (#2328)\n* refactor: move WordPress module to another repository (#2329)\n* ci: add support for ppc64le (#2281)\n* feat: add support for WASM modules (#2195)\n* feat(secret): show recommendation for slow scanning (#2051)\n* fix(flag): remove --clear-cache flag client mode (#2301)\n* fix(java): added check for looping for variable evaluation in pom file (#2322)\n* BREAKING(k8s): change CLI API (#2186)\n* feat(alpine): add Alpine Linux 3.16 (#2319)\n* ci: add `go mod tidy` check (#2314)\n* chore: run `go mod tidy` (#2313)\n* fix: do not exit if one resource is not found (#2311)\n* feat(cli): use stderr for all log messages (resolve #381) (#2289)\n* test: replace deprecated subcommand client in integration tests (#2308)\n* feat: add support for containerd (#2305)\n* fix(kubernetes): Support floats in manifest yaml (#2297)\n* docs(kubernetes): dead links (#2307)\n* chore: add license label (#2304)\n* feat(mariner): added support for CBL-Mariner Distroless v2.0 (#2293)\n* feat(helm): add pod annotations (#2272)\n* refactor: do not import defsec in fanal types package (#2292)\n* feat(report): Add misconfiguration support to ASFF report template (#2285)\n* test: use images in GHCR (#2275)\n* feat(helm): support pod annotations (#2265)\n* feat(misconf): Helm chart scanning (#2269)\n* docs: Update custom rego policy docs to reflect latest defsec/fanal changes (#2267)\n* fix: mask redis credentials when logging (#2264)\n* refactor: extract commands Runner interface (#2147)\n* docs: update operator release (#2263)\n* feat(redhat): added architecture check (#2172)\n* docs: updating links in the docs to work again (#2256)\n* docs: fix readme (#2251)\n* fix: fixed incorrect CycloneDX output format (#2255)\n* refactor(deps): move dependencies to package (#2189)\n* fix(report): change github format version to required (#2229)\n* docs: update readme (#2110)\n* docs: added information about choosing advisory database (#2212)\n* chore: update trivy-kubernetes (#2224)\n* docs: clarifying parts of the k8s docs and updating links (#2222)\n* fix(k8s): timeout error logging (#2179)\n* chore(deps): updated fanal after fix AsymmetricPrivateKeys (#2214)\n* feat(k8s): add --context flag (#2171)\n* fix(k8s): properly instantiate TableWriter (#2175)\n* test: fixed integration tests after updating testcontainers to v0.13.0 (#2208)\n* chore: update labels (#2197)\n* fix(report): fixed panic if all misconf reports were removed in filter (#2188)\n* feat(k8s): scan secrets (#2178)\n* feat(report): GitHub Dependency Snapshots support (#1522)\n* feat(db): added insecure skip tls verify to download trivy db (#2140)\n* fix(redhat): always use vulns with fixed version if there is one (#2165)\n* chore(redhat): Add support for Red Hat UBI 9. (#2183)\n* fix(k8s): update trivy-kubernetes (#2163)\n*  fix misconfig start line for code quality tpl (#2181)\n* fix: update docker/distribution from 2.8.0 to 2.8.1 (#2176)\n* docs(vuln): Include GitLab 15.0 integration (#2153)\n* docs: fix the operator version (#2167)\n* fix(k8s): summary report when when only vulns exit (#2146)\n* chore(deps): Update fanal to get defsec v0.58.2 (fixes false positives in ksv038) (#2156)\n* perf(misconf): Improve performance when scanning very large files (#2152)\n* docs(misconf): Update examples and docs to refer to builtin/defsec instead of appshield (#2150)\n* chore(deps): Update fanal (for less verbose code in misconf results) (#2151)\n* docs: fixed installation instruction for rhel/centos (#2143)\n","status":"published","published":"2022-08-06T16:01:16Z","modified":"2025-05-07T18:13:37.96931Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10094-1","title":"Security update for trivy","description":"This update for trivy fixes the following issues:\n\nUpdate to version 0.30.4:\n\n* fix: remove the first arg when running as a plugin (#2595)\n* fix: k8s controlplaner scanning (#2593)\n* fix(vuln): GitLab report template (#2578)\n\nUpdate to version 0.30.3:\n\n* fix(server): use a new db worker for hot updates (#2581)\n* docs: add trivy with download-db-only flag to Air-Gapped Environment (#2583)\n* docs: split commands to download db for different versions of oras (#2582)\n* feat(report): export exitcode for license checks (#2564)\n* fix: cli can use lowercase for severities (#2565)\n* fix: allow subcommands with TRIVY_RUN_AS_PLUGIN (#2577)\n* fix: add missing types in TypeOSes and TypeLanguages in analyzer (#2569)\n* fix: enable some features of the wasm runtime (#2575)\n* fix(k8s): no error logged if trivy can't get docker image in kubernetes mode (#2521)\n* docs(sbom): improve sbom attestation documentation (#2566)\n\nUpdate to version 0.30.2:\n\n* fix(report): show the summary without results (#2548)\n* fix(cli): replace '-' to '_' for env vars (#2561)\n\nUpdate to version 0.30.1:\n\n* chore: remove a test repository (#2551)\n* fix(license): lazy loading of classifiers (#2547)\n* fix: CVE-2022-1996 in Trivy (#2499)\n* docs(sbom): add sbom attestation (#2527)\n* feat(rocky): set Rocky Linux 9 EOL (#2543)\n* docs: add attributes to the video tag to autoplay demo videos (#2538)\n* fix: yaml files with non-string chart name (#2534)\n* fix: skip dirs (#2530)\n* feat(repo): add support for branch, commit, \u0026 tag (#2494)\n* fix: remove auto configure environment variables via viper (#2526)\n\nUpdate to version 0.30.0:\n\n* fix: separating multiple licenses from one line in dpkg copyright files (#2508)\n* fix: change a capital letter for `plugin uninstall` subcommand (#2519)\n* fix: k8s hide empty report when scanning resource (#2517)\n* refactor: fix comments (#2516)\n* fix: scan vendor dir (#2515)\n* feat: Add support for license scanning (#2418)\n* chore: add owners for secret scanning (#2485)\n* fix: remove dependency-tree flag for image subcommand (#2492)\n* fix(k8s): add shorthand for k8s namespace flag (#2495)\n* docs: add information about using multiple servers to troubleshooting (#2498)\n* ci: add pushing canary build images to registries (#2428)\n* feat(dotnet): add support for .Net core .deps.json files (#2487)\n* feat(amazon): add support for 2022 version (#2429)\n* Type correction bitnami chart (#2415)\n* docs: add config file and update CLI references (#2489)\n* feat: add support for flag groups (#2488)\n* refactor: move from urfave/cli to spf13/cobra (#2458)\n* fix: Fix secrets output not containing file/lines (#2467)\n* fix: clear output with modules (#2478)\n* docs(cbl): distroless 1.0 supported (#2473)\n* fix: Fix example dockerfile rego policy (#2460)\n* fix(config): add helm to list of config analyzers (#2457)\n* feat: k8s resouces scan (#2395)\n* feat(sbom): add cyclonedx sbom scan (#2203)\n* docs: remove links to removed content (#2431)\n* ci: added rpm build for rhel 9 (#2437)\n* fix(secret): remove space from asymmetric private key (#2434)\n* test(integration): fix golden files for debian 9 (#2435)\n* fix(cli): fix version string in docs link when secret scanning is enabled (#2422)\n* refactor: move CycloneDX marshaling (#2420)\n* docs(nodejs): add docs about pnpm support (#2423)\n* docs: improve k8s usage documentation (#2425)\n* feat: Make secrets scanning output consistant (#2410)\n* ci: create canary build after main branch changes  (#1638)\n* fix(misconf): skip broken scans (#2396)\n* feat(nodejs): add pnpm support (#2414)\n* fix: Fix false positive for use of COS images (#2413)\n* eliminate nerdctl dependency (#2412)\n* Add EOL date for SUSE SLES 15.3, 15.4 and OpenSUSE 15.4 (#2403)\n* fix(go): no cast to lowercase go package names (#2401)\n* BREAKING(sbom): change 'trivy sbom' to scan SBOM (#2408)\n* fix(server): hot update the db from custom repository (#2406)\n* feat: added license parser for dpkg (#2381)\n* fix(misconf): Update defsec (v0.68.5) to fix docker rego duplicate key (#2400)\n* feat: extract stripe publishable and secret keys (#2392)\n* feat: rbac support k8s sub-command (#2339)\n* feat(ruby): drop platform strings from dependency versions bundled with bundler v2 (#2390)\n* docs: Updating README with new CLI command (#2359)\n* fix(misconf): Update defsec to v0.68.4 to resolve CF detection bug (#2383)\n* chore: add integration label and merge security label (#2316)\n\nUpdate to version 0.29.2:\n\n* chore: skip Visual Studio Code project folder (#2379)\n* fix(helm): handle charts with templated names (#2374)\n* docs: redirect operator docs to trivy-operator repo (#2372)\n* fix(secret): use secret result when determining Failed status (#2370)\n* try removing libdb-dev\n* run integration tests in fanal\n* use same testing images in fanal\n* feat(helm): add support for trivy dbRepository (#2345)\n* fix: Fix failing test due to deref lint issue\n* test: Fix broken test\n* fix: Fix makefile when no previous named ref is visible in a shallow clone\n* chore: Fix linting issues in fanal\n* refactor: Fix fanal import paths and remove dotfiles\n\nUpdate to version 0.29.1:\n\n* fix(report): add required fields to the SARIF template (#2341)\n* chore: fix spelling errors (#2352)\n* Omit Remediation if PrimaryURL is empty (#2006)\n* docs(repo): Link to installation documentation in readme shows 404 (#2348)\n* feat(alma): support for scanning of modular packages for AlmaLinux (#2347)\n\nUpdate to version 0.29.0:\n\n* fix(lang): fix dependency graph in client server mode (#2336)\n* feat: allow expiration date for .trivyignore entries (#2332)\n* feat(lang): add dependency origin graph (#1970)\n* docs: update nix installation info (#2331)\n* feat: add rbac scanning support (#2328)\n* refactor: move WordPress module to another repository (#2329)\n* ci: add support for ppc64le (#2281)\n* feat: add support for WASM modules (#2195)\n* feat(secret): show recommendation for slow scanning (#2051)\n* fix(flag): remove --clear-cache flag client mode (#2301)\n* fix(java): added check for looping for variable evaluation in pom file (#2322)\n* BREAKING(k8s): change CLI API (#2186)\n* feat(alpine): add Alpine Linux 3.16 (#2319)\n* ci: add `go mod tidy` check (#2314)\n* chore: run `go mod tidy` (#2313)\n* fix: do not exit if one resource is not found (#2311)\n* feat(cli): use stderr for all log messages (resolve #381) (#2289)\n* test: replace deprecated subcommand client in integration tests (#2308)\n* feat: add support for containerd (#2305)\n* fix(kubernetes): Support floats in manifest yaml (#2297)\n* docs(kubernetes): dead links (#2307)\n* chore: add license label (#2304)\n* feat(mariner): added support for CBL-Mariner Distroless v2.0 (#2293)\n* feat(helm): add pod annotations (#2272)\n* refactor: do not import defsec in fanal types package (#2292)\n* feat(report): Add misconfiguration support to ASFF report template (#2285)\n* test: use images in GHCR (#2275)\n* feat(helm): support pod annotations (#2265)\n* feat(misconf): Helm chart scanning (#2269)\n* docs: Update custom rego policy docs to reflect latest defsec/fanal changes (#2267)\n* fix: mask redis credentials when logging (#2264)\n* refactor: extract commands Runner interface (#2147)\n* docs: update operator release (#2263)\n* feat(redhat): added architecture check (#2172)\n* docs: updating links in the docs to work again (#2256)\n* docs: fix readme (#2251)\n* fix: fixed incorrect CycloneDX output format (#2255)\n* refactor(deps): move dependencies to package (#2189)\n* fix(report): change github format version to required (#2229)\n* docs: update readme (#2110)\n* docs: added information about choosing advisory database (#2212)\n* chore: update trivy-kubernetes (#2224)\n* docs: clarifying parts of the k8s docs and updating links (#2222)\n* fix(k8s): timeout error logging (#2179)\n* chore(deps): updated fanal after fix AsymmetricPrivateKeys (#2214)\n* feat(k8s): add --context flag (#2171)\n* fix(k8s): properly instantiate TableWriter (#2175)\n* test: fixed integration tests after updating testcontainers to v0.13.0 (#2208)\n* chore: update labels (#2197)\n* fix(report): fixed panic if all misconf reports were removed in filter (#2188)\n* feat(k8s): scan secrets (#2178)\n* feat(report): GitHub Dependency Snapshots support (#1522)\n* feat(db): added insecure skip tls verify to download trivy db (#2140)\n* fix(redhat): always use vulns with fixed version if there is one (#2165)\n* chore(redhat): Add support for Red Hat UBI 9. (#2183)\n* fix(k8s): update trivy-kubernetes (#2163)\n*  fix misconfig start line for code quality tpl (#2181)\n* fix: update docker/distribution from 2.8.0 to 2.8.1 (#2176)\n* docs(vuln): Include GitLab 15.0 integration (#2153)\n* docs: fix the operator version (#2167)\n* fix(k8s): summary report when when only vulns exit (#2146)\n* chore(deps): Update fanal to get defsec v0.58.2 (fixes false positives in ksv038) (#2156)\n* perf(misconf): Improve performance when scanning very large files (#2152)\n* docs(misconf): Update examples and docs to refer to builtin/defsec instead of appshield (#2150)\n* chore(deps): Update fanal (for less verbose code in misconf results) (#2151)\n* docs: fixed installation instruction for rhel/centos (#2143)\n\nUpdate to version 0.28.0 (boo#1199760, CVE-2022-28946):\n\n* fix: remove Highlighted from json output (#2131)\n* fix: remove trivy-kubernetes replace (#2132)\n* docs: Add Operator docs under Kubernetes section (#2111)\n* fix(k8s): security-checks panic (#2127)\n* ci: added k8s scope (#2130)\n* docs: Update misconfig output in examples (#2128)\n* fix(misconf): Fix coloured output in Goland terminal (#2126)\n* docs(secret): Fix default value of --security-checks in docs (#2107)\n* refactor(report): move colorize function from trivy-db (#2122)\n* feat: k8s resource scanning (#2118)\n* chore: add CODEOWNERS (#2121)\n* feat(image): add `--server` option for remote scans (#1871)\n* refactor: k8s (#2116)\n* refactor: export useful APIs (#2108)\n* docs: fix k8s doc (#2114)\n* feat(kubernetes): Add report flag for summary (#2112)\n* fix: Remove problematic advanced rego policies (#2113)\n* feat(misconf): Add special output format for misconfigurations (#2100)\n* feat:  add k8s subcommand (#2065)\n* chore: fix make lint version (#2102)\n* fix(java): handle relative pom modules (#2101)\n* fix(misconf): Add missing links for non-rego misconfig results (#2094)\n* feat(misconf): Added fs.FS based scanning via latest defsec (#2084)\n* chore(os): updated fanal version and alpine distroless test (#2086)\n* feat(report): add support for SPDX (#2059)\n* chore: app version 0.27.0 (#2046)\n* fix(misconf): added to skip conf files if their scanning is not enabled (#2066)\n* docs(secret) fix rule path in docs (#2061)\n* docs: change from go.sum to go.mod (#2056)\n\nUpdate to version 0.27.1:\n\n* refactor(fs): scanner options (#2050)\n* feat(secret): truncate long line (#2052)\n* docs: fix a broken bullets (#2042)\n* feat(ubuntu): add 22.04 approx eol date (#2044)\n* docs: update installation.md (#2027)\n* docs: add Containerfile (#2032)\n\nUpdate to version 0.27.0:\n\n* fix(go): fixed panic to scan gomod without version (#2038)\n* docs(mariner): confirm it works with Mariner 2.0 VM (#2036)\n* feat(secret): support enable rules (#2035)\n* chore: app version 26.0 (#2030)\n* docs(secret): add a demo movie (#2031)\n* feat: support cache TTL in Redis (#2021)\n* fix(go): skip system installed binaries (#2028)\n* fix(go): check if go.sum is nil (#2029)\n* feat: add secret scanning (#1901)\n* chore: gh publish only with push the tag release (#2025)\n* fix(fs): ignore permission errors (#2022)\n* test(mod): using correct module inside test go.mod (#2020)\n* feat(server): re-add proxy support for client/server communications (#1995)\n* fix(report): truncate a description before escaping in ASFF template (#2004)\n* fix(cloudformation): correct margin removal for empty lines (#2002)\n* fix(template): correct check of old sarif template files (#2003)\n\nUpdate to version 0.26.0:\n\n* feat(alpine): warn mixing versions (#2000)\n* Update ASFF template (#1914)\n* chore(deps): replace `containerd/containerd` version to fix CVE-2022-23648 (#1994)\n* test(go): add integration tests for gomod (#1989)\n* fix(python): fixed panic when scan .egg archive (#1992)\n* fix(go): set correct go modules type (#1990)\n* feat(alpine): support apk repositories (#1987)\n* docs: add CBL-Mariner (#1982)\n* docs(go): fix version (#1986)\n* feat(go): support go.mod in Go 1.17+ (#1985)\n* ci: fix URLs in the PR template (#1972)\n* ci: add semantic pull requests check (#1968)\n* docs(issue): added docs for wrong detection issues (#1961)\n\nUpdate to version 0.25.4:\n\n* docs: move CONTRIBUTING.md to docs (#1971)\n* refactor(table): use file name instead package path (#1966)\n* fix(sbom): add --db-repository (#1964)\n* feat(table): add PkgPath in table result (#1960)\n* fix(pom): merge multiple pom imports in a good manner (#1959)\n\nUpdate to version 0.25.3:\n\n* fix(downloadDB): add dbRepositoryFlag to repository and rootfs commands (#1956)\n* fix(misconf): update BurntSushi/toml for fix runtime error (#1948)\n* fix(misconf): Update fanal/defsec to resolve missing metadata issues (#1947)\n* feat(jar): allow setting Maven Central URL using environment variable (#1939)\n* chore(chart): update Trivy version in HelmChart to 0.25.0 (#1931)\n* chore(chart): remove version comments (#1933)\n\nUpdate to version 0.25.2:\n\n* fix(downloadDB): add flag to server command (#1942)\n\nUpdate to version 0.25.1:\n\n* fix(misconf): update defsec to resolve panics (#1935)\n* docs: restructure the documentation (#1887)\n* Add trivy horizontal logo (#1932)\n* feat(db): Add dbRepository flag to get advisory database from OCI registry (#1873)\n\n- Buildrequire go1.18 as upstream says in go.mod\n\nUpdate to version 0.25.0:\n\n* docs(filter vulnerabilities): fix link (#1880)\n* feat(template) Add misconfigurations to gitlab codequality report (#1756)\n* fix(rpc): add PkgPath field to client / server mode (#1643)\n* fix(vulnerabilities): fixed trivy-db vulns (#1883)\n* feat(cache): remove temporary cache after filesystem scanning (#1868)\n* feat(sbom): add a dedicated sbom command (#1799)\n* feat(cyclonedx): add vulnerabilities (#1832)\n* fix(option): hide false warning about remote options (#1865)\n* feat(filesystem): scan in client/server mode (#1829)\n* refactor(template): remove unused test (#1861)\n* fix(cli): json format for trivy version (#1854)\n* docs: change URL for tfsec-checks (#1857)\n","status":"published","published":"2022-08-20T10:02:00Z","modified":"2026-02-04T03:36:31.78178Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12205-1","title":"trivy-0.30.2-1.1 on GA media","description":"These are all security issues fixed in the trivy-0.30.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:39:26.636985Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:12252-1","title":"helm-3.9.3-1.1 on GA media","description":"These are all security issues fixed in the helm-3.9.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:56:03.888323Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:14081-1","title":"containerd-1.7.17-2.1 on GA media","description":"These are all security issues fixed in the containerd-1.7.17-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-28T00:00:00Z","modified":"2026-02-04T02:36:11.768482Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15779-1","title":"helm3-3.19.2-1.1 on GA media","description":"These are all security issues fixed in the helm3-3.19.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-28T00:00:00Z","modified":"2026-02-04T03:10:43.123465Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2022:3321-1","title":"Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container","description":"This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516)\n\nSecurity issues fixed in vendored dependencies:\n\n- CVE-2022-1996: Fixed go-restful CORS bypass (bsc#1200528)\n- CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration (bsc#1199460)\n\nOther fixes:\n\n- Pack nft rules and nsswitch.conf for virt-handler\n- Only create 1MiB-aligned disk images (bsc#1199603)\n- Avoid to return nil failure message\n- Use semantic equality comparison\n- Allow to configure utility containers for update test\n- Install nftables to manage network rules\n- Install tar to allow kubectl cp ...\n- Symlink nsswitch.conf and nft rules to proper locations\n- Enable USB redirection support for QEMU\n- Install vim-small instread of vim\n- Drop libvirt-daemon-driver-storage-core\n- Install ethtool and gawk (bsc#1199392)\n- Use non-versioned appliance to avoid redundant rpm query\n- Explicitly state the dependency on kubevirt main package\n","status":"published","published":"2022-09-20T15:19:24Z","modified":"2026-02-04T03:04:14.618096Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3333-1","title":"Security update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container","description":"This update for kubevirt, virt-api-container, virt-controller-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container fixes the following issues:\n\nThe kubevirt stack was updated to version 0.54.0\n\nRelease notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0\n\nSecurity fixes:\n\n- CVE-2022-1798: Fix arbitrary file read on the host from KubeVirt VMs (bsc#1202516)\n\nSecurity fixes in vendored dependencies:\n\n- CVE-2022-1996: Fixed go-restful CORS bypass bsc#1200528)\n- CVE-2022-29162: Fixed runc incorrect handling of inheritable capabilities in default configuration (bsc#1199460)\n\n- Fix containerdisk unmount logic\n- Support topology spread constraints\n- Update libvirt-go to fix memory leak\n- Pack nft rules and nsswitch.conf for virt-handler\n- Only create 1MiB-aligned disk images (bsc#1199603)\n- Avoid to return nil failure message\n- Use semantic equality comparison\n- Drop kubevirt-psp-caasp.yaml\n- Allow to configure utility containers for update test\n- Symlink nsswitch.conf and nft rules to proper locations\n- Drop unused package libvirt-client\n- Install vim-small instead of vim\n- Remove unneeded libvirt-daemon-driver-storage-core\n- Install missing packages ethtool and gawk. Fixes bsc#1199392\n","status":"published","published":"2022-09-22T06:46:45Z","modified":"2026-02-04T02:46:07.167629Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3334-1","title":"Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer","description":"This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues:\n\nUpdate to version 1.51.0\n\n- Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0\n\nSecurity issues fixed in vendored dependencies:\n\n- CVE-2022-1996: Fixed CORS bypass (bsc#1200528)\n\n- Include additional tools used by cdi-importer:\n  cdi-containerimage-server\n  cdi-image-size-detection\n  cdi-source-update-poller\n\n- Pack only cdi-operator and cdi-cr release manifests\n- Install tar for cloning filesystem PVCs\n","status":"published","published":"2022-09-22T06:51:24Z","modified":"2026-02-04T04:33:41.109101Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3335-1","title":"Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer","description":"This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues:\n\nUpdate to version 1.43.2\n\n- Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.2\n\nSecurity issues fixed:\n\n- CVE-2022-1996: Fixed CORS bypass in go-restful vendored dependency (bsc#1200528)\n\nOther fixes:\n- Include additional tools used by cdi-importer:\n  cdi-containerimage-server\n  cdi-source-update-poller\n- Pack only cdi-{cr,operator}.yaml into the manifests RPM\n- Install tar package (used for cloning filesystem PVCs)\n","status":"published","published":"2022-09-22T06:51:44Z","modified":"2025-05-02T04:32:33.414029Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3666-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nhelm was updated to version 3.9.4:\n\n* CVE-2022-36055: Fixed denial of service through string value parsing (bsc#1203054).\n* Updating the certificates used for testing\n* Updating index handling\n\nhelm was updated to version 3.9.3:\n\n- CVE-2022-1996: Updated kube-openapi to fix an issue that could result in a CORS protection bypass (bsc#1200528).\n* Fix missing array length check on release\n\nhelm was updated to version 3.9.2:\n\n* Update of the circleci image\n\nhelm was updated  to version 3.9.1:\n\n* Update to support Kubernetes 1.24.2\n* Improve logging and safety of statefulSetReady\n* Make token caching an opt-in feature\n* Bump github.com/lib/pq from 1.10.5 to 1.10.6\n* Bump github.com/Masterminds/squirrel from 1.5.2 to 1.5.3\n\nhelm was updated to version 3.9.0:\n\n* Added a --quiet flag to helm lint\n* Added a --post-renderer-args flag to support arguments being passed to the post renderer\n* Added more checks during the signing process\n* Updated to add Kubernetes 1.24 support\n\nhelm was updated to version 3.8.2:\n\n* Bump oras.land/oras-go from 1.1.0 to 1.1.1\n* Fixing downloader plugin error handling\n* Simplify testdata charts\n* Simplify testdata charts\n* Add tests for multi-level dependencies.\n* Fix value precedence\n* Bumping Kubernetes package versions\n* Updating vcs to latest version\n* Dont modify provided transport\n* Pass http getter as pointer in tests\n* Add docs block\n* Add transport option and tests\n* Reuse http transport\n* Updating Kubernetes libs to 0.23.4 (latest)\n* fix: remove deadcode\n* fix: helm package tests\n* fix: helm package with dependency update for charts with OCI dependencies\n* Fix typo Unset the env var before func return in Unit Test\n* add legal name check\n* maint: fix syntax error in deploy.sh\n* linting issue fixed\n* only apply overwrite if version is canary\n* overwrite flag added to az storage blob upload-batch\n* Avoid querying for OCI tags can explicit version provided in chart dependencies\n* Management of bearer tokens for tag listing\n* Updating Kubernetes packages to 1.23.3\n* refactor: use `os.ReadDir` for lightweight directory reading\n* Add IngressClass to manifests to be (un)installed\n* feat(comp): Shell completion for OCI\n* Fix install memory/goroutine leak\n","status":"published","published":"2022-10-19T18:45:15Z","modified":"2026-02-04T04:29:03.34617Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4606-1","title":"Security update for helm","description":"This update for helm fixes the following issues:\n\nUpdate to version 3.10.3:\n\n- CVE-2022-23524: Fixed a denial of service in the string value parsing (bsc#1206467).\n- CVE-2022-23525: Fixed a denial of service with the repository index file (bsc#1206469).\n- CVE-2022-23526: Fixed a denial of service in the schema file handling (bsc#1206471).\n","status":"published","published":"2022-12-22T08:32:17Z","modified":"2026-02-04T03:24:39.939363Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:4727-1","title":"Security update for catatonit, containerd, runc","description":"\nThis update of runc and containerd fixes the following issues:\n\ncontainerd:\n\n- Update to containerd v1.7.8. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.8\n\n    * CVE-2022-1996: Fixed CORS bypass in go-restful (bsc#1200528)\n\ncatatonit:\n\n- Update to catatonit v0.2.0.\n  * Change license to GPL-2.0-or-later.\n\n- Update to catatont v0.1.7\n  * This release adds the ability for catatonit to be used as the only\n    process in a pause container, by passing the -P flag (in this mode no\n    subprocess is spawned and thus no signal forwarding is done).\n\n- Update to catatonit v0.1.6, which fixes a few bugs -- mainly ones related to\n  socket activation or features somewhat adjacent to socket activation (such as\n  passing file descriptors).\n\nrunc:\n\n- Update to runc v1.1.10. Upstream changelog is available from\n  https://github.com/opencontainers/runc/releases/tag/v1.1.10\n\n","status":"published","published":"2023-12-12T11:28:07Z","modified":"2026-02-04T03:23:35.63683Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:0799-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- CVE-2022-1996: Fixed CORS bypass (bsc#1200528).\n","status":"published","published":"2024-03-07T09:34:53Z","modified":"2025-05-02T04:32:33.598331Z","updated_at":"2026-11-02T15:53:54.239786Z"},{"id":"SUSE-SU-2024:3221-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- Update to containerd v1.7.21\n- CVE-2023-47108: Fixed DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics. (bsc#1217070)\n- CVE-2023-45142: Fixed DoS vulnerability in otelhttp. (bsc#1228553)\n  ","status":"published","published":"2024-09-12T11:18:44Z","modified":"2026-02-04T04:12:23.562915Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:4329-1","title":"Security update for aws-iam-authenticator","description":"This update for aws-iam-authenticator fixes the following issues:\n\n  - CVE-2022-1996: Fixed CORS bypass (bsc#1200528).\n\n","status":"published","published":"2024-12-16T13:16:50Z","modified":"2026-02-04T04:17:11.723804Z","updated_at":"2026-11-02T15:53:56.123059Z"},{"id":"SUSE-SU-2025:20091-1","title":"Security update for containerd","description":"This update for containerd fixes the following issues:\n\n- Update to containerd v1.7.21. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.21\n  Fixes CVE-2023-47108. bsc#1217070\n  Fixes CVE-2023-45142. bsc#1228553\n\n- Update to containerd v1.7.17. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.17\n\n- Update to containerd v1.7.16. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.16\n  CVE-2023-45288 bsc#1221400\n\n- Update to containerd v1.7.15. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.15\n\n- Update to containerd v1.7.14. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.14\n\n- Update to containerd v1.7.13. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.13\n\n- Update to containerd v1.7.12. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.12\n\n- Update to containerd v1.7.11. Upstream release notes:\n  https://github.com/containerd/containerd/releases/tag/v1.7.11\n  GHSA-jq35-85cj-fj4p bsc#1224323\n","status":"published","published":"2025-02-03T09:10:07Z","modified":"2026-03-23T04:48:52.304946Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2026:2643-1","title":"Security update for aws-iam-authenticator","description":"This update for aws-iam-authenticator fixes the following issues\n\n- CVE-2022-1996: CORS bypass (bsc#1200528).\n- CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass (bsc#1201395).\n- CVE-2024-39689: remove root certificates from `GLOBALTRUST` from the root store.\n- CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad.\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265842).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266651).\n\nChanges for aws-iam-authenticator:\n\n- Update to version 0.7.18\n * Merge pull request (#1062) from CaidenBorrego/new-release\n * Creating new release for CVE mitigation\n * Merge pull request (#1057) from CaidenBorrego/caidenb-versionbump\n * Merge remote-tracking branch 'upstream/master' into caidenb-versionbump\n * Bump x/net and x/sys to remediate CVEs (bsc#1266651, CVE-2026-39821)\n- Update to 0.7.17\n * Merge pull request #1051 from CaidenBorrego/caidenb-versionbump\n * bumping version from 0.7.16-\u003e0.7.17\n * Merge pull request #1047 from CaidenBorrego/caidenb-reservedprefix-fix\n * fix: honor reservedPrefixConfig for ConfigMap and CRD backends\n * Merge pull request #1046 from CaidenBorrego/caidenb-gorunner-bump\n * fix: reject malformed mapping ARN in userIDStrict mode for dynamic files\n- Update to 0.7.16\n * Merge pull request #1041 from ronaldngounou/rngounou/bump-go-1.26.3\n * Pin GitHub Actions to full-length commit SHAs\n * fix: bump go version to 1.26.3 for CVEs\n- from version 0.7.15\n * Merge pull request #1035 from Ganiredi/bump-version-0.7.15\n * Bump version to 0.7.15\n * Merge pull request #1030 from Ganiredi/1.36-k8s-deps\n * 1.36.0 dependency update\n- from version 0.7.14\n * Merge pull request #1029 from CaidenBorrego/caidenb-gorunner-bump\n * Bump version to 0.7.14\n * Bumping gorunner image tag in Dockerfile for CVE mitigation\n- from version 0.7.13\n * Merge pull request #1020 from dheeraj-coding/master\n * feat: add manual dispatch function for create-release.yml\n * Merge pull request #1019 from dheeraj-coding/master\n * fix: create-release workflow failures\n * Merge pull request #1017 from Ganiredi/1.36-k8s-deps\n * Merge pull request #1018 from dheeraj-coding/master\n * fix: build failure due to stale gcb image by updating to latest\n * Release 0.7.13\n * Merge pull request #1016 from Ganiredi/1.36-k8s-deps\n * Merge branch 'master' into 1.36-k8s-deps\n * Merge pull request #1013 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-be00ae3611\n * 1.36.rc release\n * Merge pull request #1015 from dheeraj-coding/master\n * fix: bump go version 1.26.2 for CVEs\n * chore(deps): Bump the misc-dependencies group across 3 directories with 6 updates\n (bsc#1265842, CVE-2026-33814)\n * Merge pull request #1011 from kubernetes-sigs/dependabot/go_modules/observability-dependencies-9e34dd3c34\n * Merge pull request #1009 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-b5e1eeb2d5\n * Merge pull request #1004 from bryantbiggs/chore/fix-goreleaser-deprecations\n * Merge pull request #1010 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-7118f1d525\n * chore(deps): Bump the observability-dependencies group across 2 directories with 2 updates\n * chore(deps): Bump the aws-dependencies group across 2 directories with 6 updates\n * chore(deps): Bump the misc-dependencies group across 3 directories with 2 updates\n * Merge pull request #1008 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-3ce7b5fcac\n * chore(deps): Bump the aws-dependencies group across 2 directories with 12 updates\n * Merge pull request #1006 from kubernetes-sigs/dependabot/go_modules/k8s-dependencies-09346e948b\n * chore(deps): Bump the k8s-dependencies group across 3 directories with 8 updates\n * Merge pull request #1005 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-508cd0fd8e\n * chore(deps): Bump the aws-dependencies group across 2 directories with 15 updates\n * fix: update Makefile goreleaser target for v2 compatibility\n * fix: resolve goreleaser v2 deprecations\n- Update to version 0.7.12\n * Update OWNERS in reviewers and approvers list\n * Release 0.7.12\n * ci: add verify job to catch unrun gofmt and go mod tidy\n * chore(lint): harden linter config and fix coverage gaps\n * fix(lint): add revive and unparam linters with full compliance\n * ci: add unit test job, expand golangci config, add make update/verify\n * docs(e2e): fix Go version, remove non-existent make target, fix typo\n * docs(release): remove stale ECR image update instructions and fix asset version placeholders\n * fix: address code review findings in repo cleanup branch\n * docs: rewrite development.md as a practical local dev guide\n * chore: repo cleanup, developer experience improvements\n * chore: reduce binary size by 59% (80 MB -\u003e 33 MB)\n * fix(lint): replace deprecated NewSimpleClientset and fix embedded field selector\n * fix(tests): address code review findings in integration test framework\n * fix(tests): address post-refactor issues and add go workspace\n * refactor(tests): remove k8s.io/kubernetes dependency from test modules\n * chore: update all dependencies to latest versions\n- Set GOWORK=off to make building with vendored dependencies work\n- Update to version 0.7.11\n * Merge pull request #988 from dstdfx/bump-version\n * Bump version to 0.7.11\n * Merge pull request #985 from dstdfx/bump-go-version-1.25.7\n * Update go.mod for e2e/int tests\n * Update go.mod\n * Merge pull request #986 from ShiriNmi1520/master\n * Clarify README 'Run the server' deployment instructions\n * Bump go to 1.25.7\n * Merge pull request #983 from eks-distro-pr-bot/eks-distro-pr-bot/go-version-bumps\n * Creating PR to update Go version to 1.25.6\n- Update to version 0.7.10:\n * 1.35.0 dependency update\n * Creating PR to update Go version to 1.25.5\n * chore(deps): Bump the observability-dependencies group across 2 directories with 1 update\n * chore(deps): Bump the misc-dependencies group across 3 directories with 13 updates\n * chore(deps): Bump the observability-dependencies group across 1 directory with 2 updates\n * chore(deps): Bump the misc-dependencies group across 3 directories with 27 updates\n * chore(deps): Bump the aws-dependencies group across 2 directories with 11 updates\n * chore(deps): Bump the misc-dependencies group across 2 directories with 17 updates\n- Update to version 0.7.9\n * Creating PR to update Go version to 1.25.4\n * chore(deps): Bump the aws-dependencies group across 2 directories with 13 updates\n * chore(deps): Bump golangci/golangci-lint-action in the actions group\n * chore(deps): Bump the observability-dependencies group across 3 directories with 2 updates\n * chore(deps): Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client\n * chore(deps): Bump the aws-dependencies group across 2 directories with 14 updates\n * bump golang version to 1.25.3\n * Creating PR to update Go version to 1.25.3\n * chore(deps): Bump github.com/onsi/ginkgo/v2\n * chore(deps): Bump the observability-dependencies group across 3 directories with 1 update\n * chore(deps): Bump the misc-dependencies group across 3 directories with 11 updates\n * chore(deps): Bump the misc-dependencies group across 3 directories with 5 updates\n * chore(deps): Bump the aws-dependencies group across 2 directories with 3 updates\n- Update to version 0.7.8\n * chore: Bump indirect Kubernetes dependencies to latest\n * chore: Bump Kubernetes dependencies to latest\n * Bump the misc-dependencies group across 3 directories with 18 updates\n * Bump the aws-dependencies group across 2 directories with 11 updates\n * Fix CVE-2025-47910\n * Bump go.opentelemetry.io/auto/sdk\n * Bump the aws-dependencies group across 2 directories with 1 update\n * Bump the misc-dependencies group across 3 directories with 10 updates\n- from version 0.7.7\n * add support for aws-eusc partition\n * chore: Commit changes from `make codegen`\n * fix: Use `.go-version` for the go version\n * feat: Add `golanglint-ci` pull request review; resolve all findings\n * Add haoranleo as approver\n * Bump the observability-dependencies group across 3 directories with 3 updates\n * Bump actions/setup-go from 5 to 6 in the actions group\n * Bump the misc-dependencies group across 3 directories with 8 updates\n * Bump github.com/coreos/go-oidc\n * Bump the observability-dependencies group across 3 directories with 12 updates\n- from version 0.7.6\n * feat: Update go version to `1.25`; update dependencies to latest\n to patch reported vulnerabilities\n * Force TCP URLs for etcd compatibility\n * Update go dependencies with 1.34.0\n * Bump the k8s-dependencies group across 3 directories with 8 updates\n * Bump the k8s-dependencies group across 3 directories with 1 update\n * Bump actions/checkout from 4 to 5 in the actions group\n * Bump the aws-dependencies group across 2 directories with 13 updates\n- from version 0.7.5\n * migrate hostname verification to sdk go v2\n- from version 0.7.4\n * chore: Move observability dependencies to separate dependabot update group\n * Bump the aws-dependencies group across 2 directories with 12 updates\n- from version 0.7.3\n * update Approvers/reviewers\n * update go version to 1.24.4\n * added logs for global region fallback\n * added global region fallback to imds\n * Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client\n * bumps kops and k8s versions, replaced node label 'master' with 'control-plane'\n * added imds logic back in, with EC2_METADATA enabled by default\n * removed headersourceacct from ststest, return err if no region cfg\n * added context chaining, cleanup\n * add context chaining, client config fixes\n * Move non problematic cache logs into debug\n * Rename log-level to log-verbosity, remove AutomaticEnv\n * lint fixes\n * get region from imds if not in config\n * added go.sum entries for tests/integration, fixed imds nil pointer dereference\n * Revert 'Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client'\n * added some context chaining, fixed region config in GetWithOptions\n * updated arn, deleted v1-v2 creds converter\n * updated pkg/token to v2\n * updated pkg/filecache\n * updated arn in pkg/server to use v2\n * updated pkg/server to use v2\n * upgraded ec2provider\n * Bump the misc-dependencies group across 3 directories with 5 updates\n * Bump the misc-dependencies group across 3 directories with 6 updates\n * Bump the misc-dependencies group across 3 directories with 9 updates\n * Use logrus for filecache logs\n * Add quiet mode (cache only)\n- from version 0.7.2\n * Bump the misc-dependencies group across 3 directories with 43 updates\n * Bump the k8s-dependencies group across 3 directories with 2 updates\n- from version 0.7.1\n * Revert 'Add 2 more tag validation checks'\n * Update the gorunner to v0.18.0-eks-1-32-latest\n * update the go version to 1.24.2\n * adding yue9944882 to owner\n * adds http2 support\n * Bump the aws-dependencies group across 2 directories with 3 updates\n * Update configmap.go\n * release authenticator from mainline with 0.7.0\n * Bump goreleaser/goreleaser-action from 5 to 6 in the actions group\n * Bump the misc-dependencies group across 3 directories with 41 updates\n * Remove no-op err assignment\n * Fix credential expirability check\n * chore: Update golan x package transitive dependencies\n * fix: Correct codgen script due to deprecated script removal\n * Update configmap test per 1.32.0 change in client-go\n * Update upstream dependencies to v1.32.0\n * chore: Update to go `1.23.4`\n * deps: Update `golang.org/x/crypto` library to remediate high CVE\n * chore: Add dependabot configuration to automatically check for package updates weekly\n * handle scenario when the file is created but doesn't have content\n * update code and add tests\n * remove nnmin-aws from approver list\n * add kmala to the owners list\n * update metrics dimention to stsregion\n * add default timeout for http client\n * log sts host instead of global/regional\n * update log\n * remove typo and log line\n * remove typo\n * Bump test go versions\n * add logs and metrics dimentions to find sts call success/failures on global/regional endpoints\n * Bump go minor version\n * Update aws-iam-authenticator installation command\n * use protobuf content type instead of json for k8s client\n * Update RELEASE.md\n * Bump go-restful in e2e and integration tests\n * Bump go-restful\n * Remove outdated changelog artifacts\n * Bump deploy/example.yaml version\n * Update filecache to use AWS SDK Go V2 with wrappers\n * Refactored token filecache\n * Fix x-amz-expires header value\n * Remove parameterized AWS session from token.go\n * Parse source account from sourceARN\n * Add sourceArn to sts through headers\n * Add configurable Now time for signature generation\n * cleanup to use composite literals\n * update to sig.k8s.io namespace\n * retain original field\n * update the image to latest to fix CVE-2024-39689\n * add a namespaced field\n * Update upstream dependencies to v1.31.0\n * update the go version to 1.22.5\n * Add unit test\n * skip service validation to get the default regions endpoint\n * fix: Run `go mod tidy` to fix `go.sum` files\n * fix: Update goreleaser workflow to fix warnings and artifact generation\n * update aws go sdk to 1.54.6\n * chore: Remove emeritus reviewers from `SECURITY_CONTACTS`\n * fix: Add random string to e2e test role to avoid pipeline run conflicts\n * fix: Run `go mod tidy` from `tests/integration` directory\n * chore: Update CLI dependencies `cobra` and `viper`\n * updating google.golang.org/grpc/otelgrpc to v0.47.0\n * chore: Update CI action versions, remove `push` trigger\n * chore: Align go versions and remove unused files\n * updating k8s client libraries and go version\n * adding new approvers - nnmin-aws\n * Bump go version to 1.21.8\n * Bump github.com/golang/protobuf v1.5.4, google.golang.org/protobuf v1.33.0\n * chore: Re-update to latest patch version of K8s packages\n * fix time formatting\n * refactor structs for dynamic file load\n * add support for adoption rate metrics for cam\n * add support for e2e latency for dynamic mode\n * Switch to GOTOOLCHAIN env setting from gimme\n * Switch back to use go-version from go-image-tag\n * Switch to use go-image-tag from go-version\n * Repo controlled build go version\n * chore: Re-update and align\n * fix semantic error\n * feat: Re-update K8s packages to latest release\n * fix: Use `SIGDescribe`\n * fix: Use `framework.WithDisruptive()`\n * fix: [Disruptive] in plain text is deprecated and must be added through WithDisruptive instead\n * chore: Update dependencies for `e2e` tests\n * fix: Add context to `StartTestServer`\n * fix: Align integration test `replace` versions in `go.mod`\n * fix: Fix codegen and update `replace` test integration dependencies\n * fix: Integration test dependencies run `go mod tidy`\n * fix: Downgrade `k8s.io/sample-controller` which requires updating context handling\n * chore: Update app K8s dependencies\n * adding nnmin-aws into reviewers\n * Replace deprecated `ioutil` package\n * fix base image to use latest\n * minor fix the IAM user arn verification\n * Fix role ARN comparison for user ID strict check (#669)\n * Check ARN for user ID strict check (#660)\n * Update go to 1.21.5\n * Change s3 bucket for e2e tests, current default exists somewhere (#652)\n- Bump minimum Go version to 1.25 in BuildRequires\n- Update to version 0.6.31\n- from version 0.6.30\n * Small fixes missed during cherrypicking\n * Cherry-picked file changes from commit\n https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/554/commits\n * Simplify featuregate flag parsing for SSORoleMatch\n * Support un-canonicalized ARNs in filemapper\n * Add SSO Role suffix support (#416)\n * Chore: Update golang x package transitive dependencies\n- Add -buildmode=pie to go build command line (bsc#1239947)\n- Update to version 0.6.29\n- from version 0.6.28\n * Update owners list to sync master branch\n * Lpdate log\n * Add logs and metrics dimentions to find sts call\n success/failures on global/regional endpoints\n * Return 429 for STS throttling\n- Update to 0.6.27\n- from version 0.6.26\n- from version 0.6.25\n- from version 0.6.24\n * Update the image to latest to fix CVE-2024-3968\n- from version 0.6.23\n- Update to version 0.6.22\n- Update to version 0.6.21\n- from version 0.6.20\n * Merge pull request #713 from jaidevmane/updating-otelgrpc-to-v0.51.0\n * Merge pull request #709 from bryantbiggs/chore/update-ci-versions\n * Merge pull request #708 from jaidevmane/updating-deps\n * Merge pull request #707 from jaidevmane/adding-new-approvers\n * Merge pull request #687 from bryantbiggs/chore/update-app-k8s-dependencies\n- from version 0.6.19\n * Bump github.com/golang/protobuf v1.5.4,\n google.golang.org/protobuf v1.33.0\n- from version 0.6.18\n- from version 0.6.17\n * Fix base image to use latest and release v0.6.17\n- from version 0.6.16\n- from version 0.6.15\n * Fix role ARN comparison for user ID strict check (#669) (#671)\n- Bump minimum Go version to 1.22 in BuildRequires\n- Update to version 0.6.14\n * Check ARN for user ID strict check (#660) (#664)\n * Update go to 1.21.5 (#663)\n * Update go to 1.21.4 (#648) (#659)\n- Update to version 0.6.13\n * Cherry-pick: Fix federated user ID parsing #644 (#654)\n * Fix issue 606: use latest version of aws-sdk-go (#650)\n * Change s3 bucket for e2e tests, current default exists somewhere (#653)\n- from version 0.6.12\n * Avoid parsing single quote empty inputs\n * Avoid parsing known empty inputs\n- Update to version 0.6.11\n * Optimize only rebuild mapper when the actual backend modes change\n * Add int test for dynamic backend mode\n * Add DynamicBackendMode\n * Allow running create release from Github UI\n- Update to version 0.6.10\n * Update go.sum\n * Only replace x/net\n * Add build-all-images make target\n * Enable cross-compilation in Dockerfile\n- from version 0.6.9\n * Add DynamicFileError Metric\n- from version 0.6.8\n * Add comments explicitly on what we need to do later\n * Shutdown gracefully and avoid the extra thread\n leak checks that EtcdMain barfs on\n * Switch to newer ginkgo v2\n * Bump dependencies and go version (in go.mod) (bsc#1200528, CVE-2022-1996)\n- from version 0.6.7\n * (no changes)\n- from version 0.6.6\n * Add Username Prefix Enforce for DynamicFile mode\n- from version 0.6.5\n * Update the aws sdk go version to latest\n * Update base image in Docker file\n- from version 0.6.4\n * Loop up RoleMapping with UserId in dynamocfile mode\n * Install kind if it doesn't exist to _output\n * Update server_test for expose principal ID in audit log\n * Expose Principal Id to audit log\n * Migrate away from google.com gcp project k8s-testimages\n * Build s390x/ppc64le binaries\n * Add default instance region in sts hostname\n- from version 0.6.3\n * Bump aws sdk go to v1.44.145\n * Update Dockerfile to pull from https://gallery.ecr.aws/ \\\n eks-distro-build-tooling/golang to avoid reaching pull\n rate limit from docker.io\n * Add go mod for E2E\n * Add install kind into e2e script\n * Move e2e test from start dev script + minor fix for run.sh\n * Add end to end test for mountfile mode in kind Update Makefile\n to support run e2e from either kind or kops.\n * Add end to end test for dynamicfile backend\n- Update to version 0.6.2\n * Add automatic release creation\n * Add tag workflow to release-0.6 branch\n * Remove dependency from PR #416\n * Revert 'Add SSO Role suffix support (#416)\n- from version 0.6.1\n * Test release tagging\n * Fix file permissions\n * Tag release on update to version.txt\n * Update Dockerfile to pull from\n https://gallery.ecr.aws/eks-distro-build-tooling/golang\n to avoid reaching pull rate limit from docker.io\n * Added Issue and PR templates (#517)\n * Update Dockerfile to use Golang as builder\n- from version 0.6.0\n * Print CommitID too on startup\n * Print version on startup\n * Add new backend mode DYNAMICFILE\n * Update go.mod and go.sum for tests/integrations\n * Replace tabs with spaces in go.mod\n * Bump aws sdk go to v1.44.107\n * Minor fix on the script to solve permission\n denied issue when run make start-dev\n * Working E2E tests in prow\n * Non-blocking E2E tests\n * Add e2e recipe to Makefile\n * Basic E2E testing for authenticator\n * Initialize metrics in NewVerifier() if needed\n * Added ConfiguredInitDirectories featuregate for init command\n * rm more v1alpha1 version\n * Bump 0.6 (#471)\n * Bump version in Makefile\n * Add query parameter validation for multiple parameters\n * Replace deprecated seccomp annotation with seccompProfile.\n * Replace deprecated critical pod annotation with priorityClassName.\n * Whitespace consistency fixes.\n * Use rbac.authorization.k8s.io/v1 instead of v1beta1 in example manifest.\n * Lowercase the ARN keys\n * Remove vendor directory\n * linux/amd64 only for image target\n * Don't push on image target\n- from version 0.5.16\n * Shutdown gracefully and avoid the extra thread leak\n checks that EtcdMain barfs on\n * Bump dependencies and go version (in go.mod)\n- from version 0.5.15\n- from version 0.5.14\n- from version 0.5.13\n- from version 0.5.12\n * Fix Makefile on branch release-0.5 (#520)\n * rm more v1alpha1 version (#516)\n- from version 0.5.11\n * Add end to end test for mountfile mode in kind Update\n Makefile to support run e2e from either kind or kops.\n- Update to version 0.5.10\n * Automated cherry pick of #491: Bump aws sdk go to v1.44.107 (#493)\n * Remove vendor from release-0.5 (#498)\n- Update to version 0.5.9\n * Add query parameter validation for multiple parameters (#469)\n (bsc#1201395, CVE-2022-2385)\n- from version 0.5.8\n * Revert use of upstream yaml parsing (#455)\n- from version 0.5.7\n * Remove duplicate InitMetrics by @jngo2 in (#448)\n + Fixes a crash when executing authenticator in server mode\n- from version 0.5.6\n * Bump AWS SDK to v1.43.28 (#445)\n * Use the apiversion from KUBERNETES_EXEC_INFO (#439)\n * Bump promptui module to v0.9.0 (#437)\n- from version 0.5.5\n * Use full package name for goreleaser version (#433)\n * Add sts error metric (#430)\n * Emit metric for EC2 describeInstance calls (#428)\n * Rename configmap_watch_failures to configmap_watch_failures_total (#432)\n * Simplify goreleaser Dockerfiles (#431)\n * Don't pass metrics around (#423)\n- from version 0.5.4\n * Embed go-runner into the image (#426)\n * Bump Go to 1.17 in Travis (#414)\n * Build multi-arch images (#417)\n * Add kind-based development environment (#422\n * Add jaypipes to approvers/reviewers (#407\n * Fix deps (#396\n * Fix panic when cache file can't be Stat-ed (#410\n * Fix missing status definition in v1 CRD (#411)\n * Use ./hack/install-etcd.sh (#405\n * Run integration tests with per-test role (#402\n * Add a counter for API server watch failures (#400)\n * Upgrade CRD manifest to v1 (#397\n * Move inactives to emeritus_approvers and add active users (#399)\n * Fix tests add vendor (#398)\n * Integration test framework (#395)\n * Add cloudbuild \u0026 improvements (#394)\n * Fix typo (#390)\n * Add user/role subcommands (#381)\n * goreleaser: bump release to 0.164.0 and fix config deprecations (#371)\n * Run go mod vendor (#388)\n * doc: fix typo in RELEASE.md (#376)\n * [pkg/token]: Update credential API version (#386)\n * Enrich Audit Logs with additional AWS Identity details\n (via audit logs' 'extra' map) (#372)\n- Enable vendoring for Go module dependencies\n","status":"published","published":"2026-06-26T08:35:05Z","modified":"2026-06-27T08:45:05.148057969Z","updated_at":"2026-11-02T15:54:04.519245Z"}]}}