CVE-2024-45310 vulnerabilities

Vulnerabilities for packages: kubernetes, opentelemetry-collector-contrib, ctop, syft, k3s, cadvisor, docker, grype, buildah, podman, runc, k8s-device-plugin, neuvector-scanner, grafana-alloy...

GO-2023-1533 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in github.com/anchore/syft

Credential disclosure in syft when SYFTATTESTPASSWORD environment variable set in github.com/anchore/syft...

GHSA-V23V-6JW2-98FQ vulnerabilities

Vulnerabilities for packages: buf, opentelemetry-collector-contrib, cilium-cli, k3d, trivy, aactl, syft, gh, dagger, k3s, zot, bom, buildah, flux-image-reflector-controller, kaniko, neuvector-sigstore-interface, gitsign, scorecard, timoni, zarf, k9s, dive, docker-credential-gcr, ko, kargo, docker...

CVE-2024-32473 vulnerabilities

Vulnerabilities for packages: buf, k3d, helm-push, melange, syft, dagger, policy-controller, wolfictl, docker, grype, harbor-scanner-trivy, neuvector-scanner, cri-tools, docker-compose, kaniko...

CVE-2024-32473 vulnerabilities

Vulnerabilities for packages: kaniko, policy-controller, wolfictl, neuvector-scanner, grype, policy-controller-fips, dagger, cri-tools, buf, docker, docker-compose, k3d, melange, syft, harbor-scanner-trivy-fips, helm-push, harbor-scanner-trivy...

GHSA-X84C-P2G9-RQV9 vulnerabilities

Vulnerabilities for packages: kaniko, policy-controller, wolfictl, neuvector-scanner, grype, policy-controller-fips, dagger, cri-tools, buf, docker, docker-compose, k3d, melange, syft, harbor-scanner-trivy-fips, helm-push, harbor-scanner-trivy...

GHSA-X84C-P2G9-RQV9 vulnerabilities

Vulnerabilities for packages: buf, k3d, helm-push, melange, syft, dagger, policy-controller, wolfictl, docker, grype, harbor-scanner-trivy, neuvector-scanner, cri-tools, docker-compose, kaniko...

CVE-2024-29018 vulnerabilities

Vulnerabilities for packages: kargo, tkn, cilium-cli, grype, buildkitd, zot, kaniko, ko, wolfictl, spire-server-fips, aactl, ctop, crossplane, cadvisor-fips, cadvisor, spire-server, trivy, prometheus, syft, buf, docker-compose, kubescape, loki, up, conftest-fips, conftest, dagger, melange...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: kargo, tkn, cilium-cli, grype, buildkitd, zot, kaniko, ko, wolfictl, spire-server-fips, aactl, ctop, crossplane, cadvisor-fips, cadvisor, spire-server, trivy, prometheus, syft, buf, docker-compose, kubescape, loki, up, conftest-fips, conftest, dagger, melange...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: skopeo, k9s, grype, buildkitd, zot, docker, k3d, zarf, skaffold, kaniko, nerdctl, wolfictl, ctop, newrelic-infrastructure-agent, cadvisor, podman, trivy, kubernetes, syft, kubescape, k3s, kots, runc...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: k3d, trivy, syft, k3s, zot, kaniko, kubernetes, zarf, k9s, nerdctl, docker, kubescape, newrelic-infrastructure-agent, grype, cadvisor, podman, runc, skopeo, ctop, buildkitd, skaffold, wolfictl, kots...

CVE-2024-24579 vulnerabilities

Vulnerabilities for packages: zarf, syft, k9s, wolfictl, grype, kubescape...

CVE-2024-24579 vulnerabilities

Vulnerabilities for packages: k9s, wolfictl, grype, syft, kubescape, zarf...

SUSE CVE-2023-24827

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

GHSA-JP7V-3587-2956 Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set

A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. Impact The SYFTATTESTPASSWORD environment variable is for the syft attest command to generate attested SBOMs for the given container image...

Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set

A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. Impact The SYFTATTESTPASSWORD environment variable is for the syft attest command to generate attested SBOMs for the given container image...

Information Disclosure

github.com/anchore/syft is vulnerable to Information Disclosure. The vulnerability exists due to the SYFTATTESTPASSWORD environment variable in the syft logs leaking when -vv or -vvv are used in the syft command which is any log level = DEBUG and in the attestation or SBOM only when the syft-json...

CVE-2023-24827

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

CVE-2023-24827

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

Design/Logic Flaw

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...