apk package
chainguard/jfrog-cli
pkg:apk/chainguard/jfrog-cli
Vulnerabilities (54)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-54787 | — | < 2.117.0-r1 | 2.117.0-r1 | Aug 1, 2026 | sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker | ||
| CVE-2026-56852 | — | < 2.116.0-r2 | 2.116.0-r2 | Jul 23, 2026 | A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. | ||
| CVE-2026-50163 | mod | 5.9 | < 2.115.0-r0 | 2.115.0-r0 | Jul 1, 2026 | oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks | |
| CVE-2026-50162 | mod | 5.3 | < 2.112.0-r0 | 2.112.0-r0 | Jul 1, 2026 | oras-go: oras-go: File store write outside working directory via symlink traversal | |
| CVE-2026-50151 | mod | 5.9 | < 2.112.0-r0 | 2.112.0-r0 | Jul 1, 2026 | oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload | |
| CVE-2026-48978 | low | 3.1 | < 2.112.0-r0 | 2.112.0-r0 | Jul 1, 2026 | oras-go: oras-go: Information disclosure and TLS downgrade via malicious registry realm | |
| CVE-2026-53492 | hig | — | < 2.112.0-r0 | 2.112.0-r0 | Jun 19, 2026 | ### Impact containerd's CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations fro | |
| CVE-2026-53489 | hig | — | < 2.112.0-r0 | 2.112.0-r0 | Jun 19, 2026 | ### Impact A bug was found in containerd where the CRI plugin restores `container.log` from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via `kubectl logs`. ### Patches This bug has been fixed in the following | |
| CVE-2026-53488 | hig | — | < 2.109.0-r1 | 2.109.0-r1 | Jun 19, 2026 | ### Impact A bug was found in containerd where the CRI plugin propagates labels from an image config (`LABEL` instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels f | |
| CVE-2026-50195 | — | < 2.112.0-r0 | 2.112.0-r0 | Jun 19, 2026 | ## Impact containerd's CRI checkpoint import process contains a vulnerability where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to | ||
| CVE-2026-47262 | — | < 2.109.0-r1 | 2.109.0-r1 | Jun 19, 2026 | ### Impact A vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the contai | ||
| CVE-2026-45571 | Med | 5.4 | < 2.104.0-r1 | 2.104.0-r1 | May 27, 2026 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These v | |
| CVE-2026-45570 | Cri | 9.6 | < 2.104.0-r1 | 2.104.0-r1 | May 27, 2026 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A reposito | |
| CVE-2026-45022 | Hig | 7.5 | < 2.103.0-r2 | 2.103.0-r2 | May 27, 2026 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representa | |
| CVE-2026-46598 | Med | 5.3 | < 0 | 0 | May 22, 2026 | For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. | |
| CVE-2026-46597 | Hig | 7.5 | < 2.104.1-r2 | 2.104.1-r2 | May 22, 2026 | An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. | |
| CVE-2026-46595 | Cri | 10.0 | < 0 | 0 | May 22, 2026 | Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. | |
| CVE-2026-39835 | Med | 5.3 | < 2.104.1-r2 | 2.104.1-r2 | May 22, 2026 | SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil. | |
| CVE-2026-39834 | Cri | 9.1 | < 2.104.1-r2 | 2.104.1-r2 | May 22, 2026 | When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent trunca | |
| CVE-2026-39833 | Cri | 9.1 | < 0 | 0 | May 22, 2026 | The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns a |
- CVE-2026-54787Aug 1, 2026affected < 2.117.0-r1fixed 2.117.0-r1
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker
- CVE-2026-56852Jul 23, 2026affected < 2.116.0-r2fixed 2.116.0-r2
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
- affected < 2.115.0-r0fixed 2.115.0-r0
oras-go: Oras-go: Information disclosure and arbitrary file access via crafted tarball hardlinks
- affected < 2.112.0-r0fixed 2.112.0-r0
oras-go: oras-go: File store write outside working directory via symlink traversal
- affected < 2.112.0-r0fixed 2.112.0-r0
oras-go: oras-go: Credential forwarding via unvalidated Location header during blob upload
- affected < 2.112.0-r0fixed 2.112.0-r0
oras-go: oras-go: Information disclosure and TLS downgrade via malicious registry realm
- affected < 2.112.0-r0fixed 2.112.0-r0
### Impact containerd's CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a checkpoint, containerd preserves CDI-related annotations fro
- affected < 2.112.0-r0fixed 2.112.0-r0
### Impact A bug was found in containerd where the CRI plugin restores `container.log` from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via `kubectl logs`. ### Patches This bug has been fixed in the following
- affected < 2.109.0-r1fixed 2.109.0-r1
### Impact A bug was found in containerd where the CRI plugin propagates labels from an image config (`LABEL` instruction in Dockerfile) to a container without validation. This may result in executing an arbitrary command on the host, via a plugin that consumes container labels f
- CVE-2026-50195Jun 19, 2026affected < 2.112.0-r0fixed 2.112.0-r0
## Impact containerd's CRI checkpoint import process contains a vulnerability where it fails to validate the image references specified within a checkpoint image's configuration. An attacker with permissions to create pods can use a crafted checkpoint image to force containerd to
- CVE-2026-47262Jun 19, 2026affected < 2.109.0-r1fixed 2.109.0-r1
### Impact A vulnerability in containerd allows a maliciously crafted image to cause a Denial of Service (DoS) condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory (OOM) kill of the containerd process. This renders the contai
- affected < 2.104.0-r1fixed 2.104.0-r1
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, a path validation issue in go-git could allow crafted repository data to affect files outside the intended checkout target, including the repository's .git directory. These v
- affected < 2.104.0-r1fixed 2.104.0-r1
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.1 and 6.0.0-alpha.4, go-git's SSH transport constructs the remote exec command by wrapping the repository path in single quotes without escaping single quotes embedded inside the path. A reposito
- affected < 2.103.0-r2fixed 2.103.0-r2
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.0 and 6.0.0-alpha.3, go-git may parse malformed Git objects in a way that differs from upstream Git. When commit or tag objects contain ambiguous or malformed headers, go-git’s decoded representa
- affected < 0fixed 0
For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.
- affected < 2.104.1-r2fixed 2.104.1-r2
An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.
- affected < 0fixed 0
Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.
- affected < 2.104.1-r2fixed 2.104.1-r2
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
- affected < 2.104.1-r2fixed 2.104.1-r2
When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent trunca
- affected < 0fixed 0
The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns a
Page 1 of 3