jmespath / jmespath/jp

The current release 0.2.1 has known critical trivy vulnerabilities

Open
#51 0 comments 2 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
786
Forks
48
PR merge metrics
No merged PRs in 30d

Description

The current release available (0.2.1) has the following CVE's detected:

```
usr/local/bin/jp (gobinary)
===========================
Total: 1 (CRITICAL: 1)

┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼────────────────────────────────────────────────────────────┤
│ stdlib │ CVE-2024-24790 │ CRITICAL │ fixed │ 1.17.1 │ 1.21.11, 1.22.4 │ golang: net/netip: Unexpected behavior from Is methods for │
│ │ │ │ │ │ │ IPv4-mapped IPv6 addresses │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-24790 │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴────────────────────────────────────────────────────────────┘
````

Also:
```
┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────┬────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────┼────────────────────────────────────────────────────────────┤
│ stdlib │ CVE-2022-23806 │ CRITICAL │ fixed │ 1.17.1 │ 1.16.14, 1.17.7 │ golang: crypto/elliptic: IsOnCurve returns true for invalid │
│ │ │ │ │ │ │ field elements │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2022-23806 │
│ ├────────────────┤ │ │ ├─────────────────┼─────────────────────────────────────────────────────────────┤
│ │ CVE-2023-24538 │ │ │ │ 1.19.8, 1.20.3 │ golang: html/template: backticks not treated as string │
│ │ │ │ │ │ │ delimiters │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-24538 │
│ ├────────────────┤ │ │ ├─────────────────┼─────────────────────────────────────────────────────────────┤
│ │ CVE-2023-24540 │ │ │ │ 1.19.9, 1.20.4 │ golang: html/template: improper handling of JavaScript │
│ │ │ │ │ │ │ whitespace │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2023-24540 │
└─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────┴─────────────────────────────────────────────────────────────┘
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.