Vulnerabilities found for kfam:1.9.0


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://aquasecurity.github.io/trivy/v0.56/docs/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.

charmedkubeflow/kfam:1.9.0-afd96fb (ubuntu 22.04)
=================================================
Total: 0 (HIGH: 0, CRITICAL: 0)

access-management (gobinary)
============================
Total: 8 (HIGH: 7, CRITICAL: 1)

┌──────────────────────────┬─────────────────────┬──────────┬────────┬────────────────────────────────────┬───────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│         Library          │    Vulnerability    │ Severity │ Status │         Installed Version          │           Fixed Version           │                            Title                             │
├──────────────────────────┼─────────────────────┼──────────┼────────┼────────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ github.com/gogo/protobuf │ CVE-2021-3121       │ HIGH     │ fixed  │ v1.3.1                             │ 1.3.2                             │ gogo/protobuf: plugin/unmarshal/unmarshal.go lacks certain   │
│                          │                     │          │        │                                    │                                   │ index validation                                             │
│                          │                     │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2021-3121                    │
├──────────────────────────┼─────────────────────┤          │        ├────────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ k8s.io/apimachinery      │ GHSA-74fp-r6jw-h4mp │          │        │ v0.0.0-20190221084156-01f179d85dbc │ 0.0.0-20190927203648-9ce6eca90e73 │ Kubernetes apimachinery packages vulnerable to unbounded     │
│                          │                     │          │        │                                    │                                   │ recursion in JSON or YAML parsing...                         │
│                          │                     │          │        │                                    │                                   │ https://github.com/advisories/GHSA-74fp-r6jw-h4mp            │
├──────────────────────────┼─────────────────────┼──────────┤        ├────────────────────────────────────┼───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ stdlib                   │ CVE-2024-24790      │ CRITICAL │        │ 1.19.13                            │ 1.21.11, 1.22.4                   │ golang: net/netip: Unexpected behavior from Is methods for   │
│                          │                     │          │        │                                    │                                   │ IPv4-mapped IPv6 addresses                                   │
│                          │                     │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2024-24790                   │
│                          ├─────────────────────┼──────────┤        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                          │ CVE-2023-39325      │ HIGH     │        │                                    │ 1.20.10, 1.21.3                   │ golang: net/http, x/net/http2: rapid stream resets can cause │
│                          │                     │          │        │                                    │                                   │ excessive work (CVE-2023-44487)                              │
│                          │                     │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2023-39325                   │
│                          ├─────────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                          │ CVE-2023-45283      │          │        │                                    │ 1.20.11, 1.21.4, 1.20.12, 1.21.5  │ The filepath package does not recognize paths with a \??\    │
│                          │                     │          │        │                                    │                                   │ prefix as...                                                 │
│                          │                     │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2023-45283                   │
│                          ├─────────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                          │ CVE-2023-45287      │          │        │                                    │ 1.20.0                            │ golang: crypto/tls: Timing Side Channel attack in RSA based  │
│                          │                     │          │        │                                    │                                   │ TLS key exchanges....                                        │
│                          │                     │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2023-45287                   │
│                          ├─────────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                          │ CVE-2023-45288      │          │        │                                    │ 1.21.9, 1.22.2                    │ golang: net/http, x/net/http2: unlimited number of           │
│                          │                     │          │        │                                    │                                   │ CONTINUATION frames causes DoS                               │
│                          │                     │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2023-45288                   │
│                          ├─────────────────────┤          │        │                                    ├───────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                          │ CVE-2024-34156      │          │        │                                    │ 1.22.7, 1.23.1                    │ encoding/gob: golang: Calling Decoder.Decode on a message    │
│                          │                     │          │        │                                    │                                   │ which contains deeply nested structures...                   │
│                          │                     │          │        │                                    │                                   │ https://avd.aquasec.com/nvd/cve-2024-34156                   │
└──────────────────────────┴─────────────────────┴──────────┴────────┴────────────────────────────────────┴───────────────────────────────────┴──────────────────────────────────────────────────────────────┘
Details: https://github.com/canonical/kubeflow-rocks/actions/runs/11981483379
canonical / kubeflow-rocks

Vulnerabilities found for kfam:1.9.0 #149

Vulnerabilities found for kfam:1.9.0
