testkube-tw-toolkit-2.15.0_linux_arm64

digest	sha256:4f76f776b0adb3075445f9e1fbf68d61d6b9fd1771c362c4b22297e095f7bc11
vulnerabilities
platform	linux/arm64
size	49 MB
packages	212

zlib 1.3.2-r1 (apk) pkg:apk/alpine/zlib@1.3.2-r1?arch=aarch64&distro=alpine-3.24.3 # tw-toolkit.Dockerfile (30:30) FROM ${ALPINE_IMAGE} Affected range <1.4-r0 Fixed version 1.4-r0 EPSS Score 0.263% EPSS Percentile 18th percentile Description

libexpat 2.9.0-r0 (apk) pkg:apk/alpine/libexpat@2.9.0-r0?arch=aarch64&distro=alpine-3.24.3&upstream=expat # tw-toolkit.Dockerfile (31:31) RUN apk --no-cache upgrade && apk --no-cache add 'ca-certificates>=20261020-r0' libssl3 git openssh-client "libexpat>=2.9.0-r0" "zlib>=1.3.2-r1" "brotli-libs>=1.2.1-r0" "libcurl>=8.23.0-r0" Affected range <2.10.0-r0 Fixed version 2.10.0-r0 EPSS Score 0.448% EPSS Percentile 39th percentile Description Affected range <2.10.0-r0 Fixed version 2.10.0-r0 EPSS Score 0.391% EPSS Percentile 33rd percentile Description Affected range <2.10.0-r0 Fixed version 2.10.0-r0 EPSS Score 0.425% EPSS Percentile 37th percentile Description Affected range <2.10.0-r0 Fixed version 2.10.0-r0 EPSS Score 0.494% EPSS Percentile 43rd percentile Description

golang.org/x/net 0.60.0 (golang) pkg:golang/golang.org/x/net@0.60.0 # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range <0.62.0 Fixed version 0.62.0 EPSS Score 0.409% EPSS Percentile 35th percentile Description When coalescing adjacent text nodes in addText and fosterParent, appending to an existing TextNode's Data via string concatenation (n.Data += text) reallocated and copied the accumulated string on every token. Inputs containing many short text runs separated by ignored end tags (such as "a") caused O(n^2) allocations and byte copies. Accumulate coalesced text in per-node byte slices during parsing and materialize Data strings once at the end of parse. Affected range <0.62.0 Fixed version 0.62.0 EPSS Score 0.267% EPSS Percentile 19th percentile Description In childTextNodesAreLiteral, walking up the tree previously stopped at the nearest foreign ancestor once an HTML integration point was found. However, that integration point may itself be a descendant of an element that was foster-parented into a foreign namespace (such as or fostered under ), causing a parser to resolve the subtree in a different foreign namespace upon re-parsing the rendered output. Continue walking the full ancestor chain and verify that every transition from a non-empty namespace occurs at an HTML integration point before emitting literal text.

github.com/docker/cli 29.7.2+incompatible (golang) pkg:golang/github.com/docker/cli@29.7.2%2Bincompatible # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range >=19.03.0+incompatible Fixed version Not Fixed EPSS Score 0.549% EPSS Percentile 46th percentile Description Docker CLI Plugins: Uncontrolled Search Path Element Leads to Local Privilege Escalation on Windows in github.com/docker/cli

openssh-keygen 10.3_p1-r1 (apk) pkg:apk/alpine/openssh-keygen@10.3_p1-r1?arch=aarch64&distro=alpine-3.24.3&upstream=openssh # tw-toolkit.Dockerfile (31:31) RUN apk --no-cache upgrade && apk --no-cache add 'ca-certificates>=20261020-r0' libssl3 git openssh-client "libexpat>=2.9.0-r0" "zlib>=1.3.2-r1" "brotli-libs>=1.2.1-r0" "libcurl>=8.23.0-r0" Affected range <10.6_p2-r0 Fixed version 10.6_p2-r0 EPSS Score 1.014% EPSS Percentile 63rd percentile Description

openssh-client-common 10.3_p1-r1 (apk) pkg:apk/alpine/openssh-client-common@10.3_p1-r1?arch=aarch64&distro=alpine-3.24.3&upstream=openssh # tw-toolkit.Dockerfile (31:31) RUN apk --no-cache upgrade && apk --no-cache add 'ca-certificates>=20261020-r0' libssl3 git openssh-client "libexpat>=2.9.0-r0" "zlib>=1.3.2-r1" "brotli-libs>=1.2.1-r0" "libcurl>=8.23.0-r0" Affected range <10.6_p2-r0 Fixed version 10.6_p2-r0 EPSS Score 1.014% EPSS Percentile 63rd percentile Description

musl 1.2.6-r3 (apk) pkg:apk/alpine/musl@1.2.6-r3?arch=aarch64&distro=alpine-3.24.3 # tw-toolkit.Dockerfile (30:30) FROM ${ALPINE_IMAGE} Affected range <1.2.6-r6 Fixed version 1.2.6-r6 EPSS Score 0.549% EPSS Percentile 46th percentile Description

musl-utils 1.2.6-r3 (apk) pkg:apk/alpine/musl-utils@1.2.6-r3?arch=aarch64&distro=alpine-3.24.3&upstream=musl # tw-toolkit.Dockerfile (30:30) FROM ${ALPINE_IMAGE} Affected range <1.2.6-r6 Fixed version 1.2.6-r6 EPSS Score 0.549% EPSS Percentile 46th percentile Description

openssh-client-default 10.3_p1-r1 (apk) pkg:apk/alpine/openssh-client-default@10.3_p1-r1?arch=aarch64&distro=alpine-3.24.3&upstream=openssh # tw-toolkit.Dockerfile (31:31) RUN apk --no-cache upgrade && apk --no-cache add 'ca-certificates>=20261020-r0' libssl3 git openssh-client "libexpat>=2.9.0-r0" "zlib>=1.3.2-r1" "brotli-libs>=1.2.1-r0" "libcurl>=8.23.0-r0" Affected range <10.6_p2-r0 Fixed version 10.6_p2-r0 EPSS Score 1.014% EPSS Percentile 63rd percentile Description

golang.org/x/crypto 0.57.0 (golang) pkg:golang/golang.org/x/crypto@0.57.0 # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range <0.58.1-0.20261009181718-2f1f834330b2 Fixed version 0.58.1-0.20261009181718-2f1f834330b2 Description The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. If you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.

github.com/chrismellard/docker-credential-acr-env 0.0.0-20230304212654-82a0ddb27589 (golang) pkg:golang/github.com/chrismellard/docker-credential-acr-env@0.0.0-20230304212654-82a0ddb27589 # tw-toolkit.Dockerfile (34:34) COPY --from=build /app/testworkflow-init /init Affected range >=0 Fixed version Not Fixed Description In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.