buildah vulnerabilities (Alpaquita)
36 vulnerabilities.
buildahAlpaquitaPodman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers3.3 LowbuildahAlpaquitaHTTP/2 server crash due to HPACK encoder race in net/http7.5 HighbuildahAlpaquitaExcessive CPU consumption from repeated initial window changes in net/http7.5 HighbuildahAlpaquitaDouble flow control refund on HTTP/2 server streams in net/http9.1 CriticalbuildahAlpaquitaPodman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers4.5 MediumbuildahAlpaquitaSource-address critical option not enforced for non-public-key auth callbacks in golang.org/x/crypto/ssh7.5 HighbuildahAlpaquitaTar extraction in moby/go-archive can write outside the destination directory via link following7.1 HighbuildahAlpaquitaParsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage7.5 HighbuildahAlpaquitaInvoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html6.1 MediumbuildahAlpaquitaInvoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html6.1 MediumbuildahAlpaquitaInvoking duplicate attributes can cause XSS in golang.org/x/net/html6.1 MediumbuildahAlpaquitaInvoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html6.1 MediumbuildahAlpaquitaInvoking denial of service when parsing arbitrary HTML in golang.org/x/net/html6.5 MediumbuildahAlpaquitaInvoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent5.3 MediumbuildahAlpaquitaInvoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh7.5 HighbuildahAlpaquitaInvoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh10.0 CriticalbuildahAlpaquitaInvoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts9.1 CriticalbuildahAlpaquitaInvoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh5.3 MediumbuildahAlpaquitaInvoking infinite loop on large channel writes in golang.org/x/crypto/ssh9.1 CriticalbuildahAlpaquitaInvoking key constraints not enforced in golang.org/x/crypto/ssh/agent9.1 CriticalbuildahAlpaquitaInvoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent9.1 CriticalbuildahAlpaquitaInvoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh9.1 CriticalbuildahAlpaquitaInvoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh9.1 CriticalbuildahAlpaquitaInvoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh7.5 HighbuildahAlpaquitaInvoking bypass of certificate restrictions in golang.org/x/crypto/ssh6.3 MediumbuildahAlpaquitaInvoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh6.5 MediumbuildahAlpaquitarunc: LSM labels can be bypassed with malicious config using dummy procfs files7.3 HighbuildahAlpaquitaPodman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile8.6 HighbuildahAlpaquitaPodman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)6.5 MediumbuildahAlpaquitaBuildah: buildah allows arbitrary directory mount7.8 HighbuildahAlpaquitaBuildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction4.7 MediumbuildahAlpaquitaPodman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library5.4 MediumbuildahAlpaquitaContainers/image: digest type does not guarantee valid type8.3 HighbuildahAlpaquitaBuildah: buildah: container escape via improper bind mount validation8.6 HighbuildahAlpaquitaPrefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin5.9 MediumbuildahAlpaquitaInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna9.6 Critical