github.com/kyverno/kyverno-v1.12.5: 9 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github]

Vulnerable Library - github.com/kyverno/kyverno-v1.12.5

Library home page: https://proxy.golang.org/github.com/kyverno/kyverno/@v/v1.12.5.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/kyverno/kyverno/@v/v1.12.5.mod

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (github.com/kyverno/kyverno-v1.12.5 version)	Remediation Possible**
CVE-2025-27144	High	7.5	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2025-22869	High	7.5	golang.org/x/crypto-v0.31.0	Transitive	N/A*	❌
CVE-2025-22868	High	7.5	golang.org/x/oauth2-v0.23.0	Transitive	N/A*	❌
CVE-2024-36620	Medium	6.5	github.com/Docker/Docker-v25.0.5+incompatible	Transitive	N/A*	❌
CVE-2024-6531	Medium	6.4	github.com/open-Policy-agent/opa-v0.63.0	Transitive	N/A*	❌
CVE-2025-29778	Medium	5.8	github.com/kyverno/kyverno-v1.12.5	Direct	https://github.com/kyverno/kyverno.git - v1.14.0	❌
CVE-2025-22870	Medium	4.4	golang.org/x/net-v0.33.0	Transitive	N/A*	❌
CVE-2024-48921	Low	2.7	github.com/kyverno/kyverno-v1.12.5	Direct	github.com/kyverno/kyverno-v1.13.0	❌
CVE-2024-47534	Low	0.0	github.com/theupdateframework/go-tuf-v0.7.0	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-27144

Vulnerable Libraries - github.com/go-jose/go-jose/v4-v4.0.1, gopkg.in/go-jose/go-jose.v2-v2.6.3, github.com/go-jose/go-jose/v3-v3.0.3

github.com/go-jose/go-jose/v4-v4.0.1

An implementation of JOSE standards (JWE, JWS, JWT) in Go

Library home page: https://proxy.golang.org/github.com/go-jose/go-jose/v4/@v/v4.0.1.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/go-jose/go-jose/v4/@v/v4.0.1.mod

Dependency Hierarchy:

• github.com/kyverno/kyverno-v1.12.5 (Root Library)
  • github.com/sigstore/k8s-manifest-sigstore-v0.5.4
    • github.com/sigstore/sigstore-v1.8.3
      • github.com/coreos/go-oidc/v3-v3.10.0
        • ❌ github.com/go-jose/go-jose/v4-v4.0.1 (Vulnerable Library)

gopkg.in/go-jose/go-jose.v2-v2.6.3

An implementation of JOSE standards (JWE, JWS, JWT) in Go

Library home page: https://proxy.golang.org/gopkg.in/go-jose/go-jose.v2/@v/v2.6.3.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/gopkg.in/go-jose/go-jose.v2/@v/v2.6.3.mod

Dependency Hierarchy:

• github.com/kyverno/kyverno-v1.12.5 (Root Library)
  • github.com/sigstore/k8s-manifest-sigstore-v0.5.4
    • github.com/sigstore/sigstore-v1.8.3
      • github.com/letsencrypt/boulder-v0.0.0-20240127020530-97a19b18d21e
        • ❌ gopkg.in/go-jose/go-jose.v2-v2.6.3 (Vulnerable Library)

github.com/go-jose/go-jose/v3-v3.0.3

An implementation of JOSE standards (JWE, JWS, JWT) in Go

Library home page: https://proxy.golang.org/github.com/go-jose/go-jose/v3/@v/v3.0.3.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/go-jose/go-jose/v3/@v/v3.0.3.mod

Dependency Hierarchy:

• github.com/kyverno/kyverno-v1.12.5 (Root Library)
  • github.com/sigstore/k8s-manifest-sigstore-v0.5.4
    • github.com/sigstore/sigstore-v1.8.3
      • ❌ github.com/go-jose/go-jose/v3-v3.0.3 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of "." characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of "." characters.

Publish Date: 2025-02-24

URL: CVE-2025-27144

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c6gw-w398-hv78

Release Date: 2025-02-24

Fix Resolution: v4.0.5

Step up your Open Source Security Game with Mend here

CVE-2025-22869

Vulnerable Library - golang.org/x/crypto-v0.31.0

Library home page: https://proxy.golang.org/golang.org/x/crypto/@v/v0.31.0.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/golang.org/x/crypto/@v/v0.31.0.mod

Dependency Hierarchy:

• github.com/kyverno/kyverno-v1.12.5 (Root Library)
  • github.com/sigstore/k8s-manifest-sigstore-v0.5.4
    • github.com/Protonmail/go-crypto-v1.0.0
      • ❌ golang.org/x/crypto-v0.31.0 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

Publish Date: 2025-02-26

URL: CVE-2025-22869

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://pkg.go.dev/vuln/GO-2025-3487

Release Date: 2025-02-26

Fix Resolution: v0.35.0

Step up your Open Source Security Game with Mend here

CVE-2025-22868

Vulnerable Library - golang.org/x/oauth2-v0.23.0

Library home page: https://proxy.golang.org/golang.org/x/oauth2/@v/v0.23.0.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/golang.org/x/oauth2/@v/v0.23.0.mod

Dependency Hierarchy:

• github.com/kyverno/kyverno-v1.12.5 (Root Library)
  • github.com/sigstore/k8s-manifest-sigstore-v0.5.4
    • github.com/Google/go-containerregistry-v0.19.1
      • ❌ golang.org/x/oauth2-v0.23.0 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.

Publish Date: 2025-02-26

URL: CVE-2025-22868

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://pkg.go.dev/vuln/GO-2025-3488

Release Date: 2025-02-26

Fix Resolution: v0.27.0

Step up your Open Source Security Game with Mend here

CVE-2024-36620

Vulnerable Library - github.com/Docker/Docker-v25.0.5+incompatible

Moby Project - a collaborative project for the container ecosystem to assemble container-based systems

Library home page: https://proxy.golang.org/github.com/!docker/!docker/@v/v25.0.5+incompatible.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/docker/docker/@v/v25.0.5+incompatible.mod

Dependency Hierarchy:

• github.com/kyverno/kyverno-v1.12.5 (Root Library)
  • github.com/sigstore/k8s-manifest-sigstore-v0.5.4
    • github.com/Google/go-containerregistry-v0.19.1
      • github.com/Docker/cli-v25.0.1+incompatible
        • ❌ github.com/Docker/Docker-v25.0.5+incompatible (Vulnerable Library)

Found in base branch: main

Vulnerability Details

moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

Publish Date: 2024-11-29

URL: CVE-2024-36620

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q59j-vv4j-v33c

Release Date: 2024-11-29

Fix Resolution: github.com/moby/moby-v26.1.0

Step up your Open Source Security Game with Mend here

CVE-2024-6531

Vulnerable Library - github.com/open-Policy-agent/opa-v0.63.0

Open Policy Agent (OPA) is an open source, general-purpose policy engine.

Library home page: https://proxy.golang.org/github.com/open-!policy-agent/opa/@v/v0.63.0.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/open-policy-agent/opa/@v/v0.63.0.mod

Dependency Hierarchy:

• github.com/kyverno/kyverno-v1.12.5 (Root Library)
  • github.com/sigstore/k8s-manifest-sigstore-v0.5.4
    • github.com/sigstore/cosign/v2-v2.2.4
      • ❌ github.com/open-Policy-agent/opa-v0.63.0 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.

Publish Date: 2024-07-11

URL: CVE-2024-6531

CVSS 3 Score Details (6.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vc8w-jr9v-vj7f

Release Date: 2024-07-11

Fix Resolution: bootstrap - 5.0.0

Step up your Open Source Security Game with Mend here

CVE-2025-29778

Vulnerable Library - github.com/kyverno/kyverno-v1.12.5

Library home page: https://proxy.golang.org/github.com/kyverno/kyverno/@v/v1.12.5.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/kyverno/kyverno/@v/v1.12.5.mod

Dependency Hierarchy:

• ❌ github.com/kyverno/kyverno-v1.12.5 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.

Publish Date: 2025-03-24

URL: CVE-2025-29778

CVSS 3 Score Details (5.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-03-24

Fix Resolution: https://github.com/kyverno/kyverno.git - v1.14.0

Step up your Open Source Security Game with Mend here

CVE-2025-22870

Vulnerable Library - golang.org/x/net-v0.33.0

Library home page: https://proxy.golang.org/golang.org/x/net/@v/v0.33.0.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/golang.org/x/net/@v/v0.33.0.mod

Dependency Hierarchy:

• github.com/kyverno/kyverno-v1.12.5 (Root Library)
  • github.com/sigstore/k8s-manifest-sigstore-v0.5.4
    • github.com/sigstore/cosign/v2-v2.2.4
      • cuelang.org/go-v0.8.1
        • ❌ golang.org/x/net-v0.33.0 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Go net/http, x/net/proxy, x/net/http/httpproxy there is a proxy bypass vulnerability using IPv6 zone IDs. Matching of hosts against proxy patterns could improperly treat an IPv6 zone ID
as a hostname component. For example, when the NO_PROXY environment variable was
set to "*.example.com", a request to "[::1%25.example.com]:80` would incorrectly
match and not be proxied. This affects versions before 1.23.7 and 1.24.x before 1.24.1.

Publish Date: 2025-03-12

URL: CVE-2025-22870

CVSS 3 Score Details (4.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2024-48921

Vulnerable Library - github.com/kyverno/kyverno-v1.12.5

Library home page: https://proxy.golang.org/github.com/kyverno/kyverno/@v/v1.12.5.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/kyverno/kyverno/@v/v1.12.5.mod

Dependency Hierarchy:

• ❌ github.com/kyverno/kyverno-v1.12.5 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. "disallow-privileged-containers," can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.

Publish Date: 2024-10-29

URL: CVE-2024-48921

CVSS 3 Score Details (2.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qjvc-p88j-j9rm

Release Date: 2024-10-29

Fix Resolution: github.com/kyverno/kyverno-v1.13.0

Step up your Open Source Security Game with Mend here

CVE-2024-47534

Vulnerable Library - github.com/theupdateframework/go-tuf-v0.7.0

Library home page: https://proxy.golang.org/github.com/theupdateframework/go-tuf/@v/v0.7.0.zip

Path to dependency file: /go.mod

Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/github.com/theupdateframework/go-tuf/@v/v0.7.0.mod

Dependency Hierarchy:

• github.com/kyverno/kyverno-v1.12.5 (Root Library)
  • github.com/sigstore/k8s-manifest-sigstore-v0.5.4
    • github.com/sigstore/sigstore-v1.8.3
      • ❌ github.com/theupdateframework/go-tuf-v0.7.0 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

go-tuf is a Go implementation of The Update Framework (TUF). The go-tuf client inconsistently traces the delegations. For example, if targets delegate to "A", and to "B", and "B" delegates to "C", then the client should trace the delegations in the order "A" then "B" then "C" but it may incorrectly trace the delegations "B"->"C"->"A". This vulnerability is fixed in 2.0.1.

Publish Date: 2024-10-01

URL: CVE-2024-47534

CVSS 3 Score Details (0.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-4f8r-qqr9-fq8j

Release Date: 2024-10-01

Fix Resolution: theupdateframework/go-tuf-v2.0.1

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.