The scanner component of the devguard project

devguard-scanner

An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3. It displays values of secrets when the --dry-run flag is used. This is a security concern in some use cases, such as a --dry-run call by a CI/CD tool. NOTE: the vendor's position is that this behavior was introduced intentionally, and cannot be removed without breaking backwards compatibility (some users may be relying on these values). Also, it is not the Helm Project's responsibility if a user decides to use --dry-run within a CI/CD environment whose output is visible to unauthorized persons.

Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a message which contains deeply nested structures.

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

A SMB force-authentication vulnerability exists in all versions of OPA for Windows prior to v0.68.0. The vulnerability exists because of improper input validation, allowing a user to pass an arbitrary SMB share instead of a Rego file as an argument to OPA CLI or to one of the OPA Go library’s functions.

Robot User

Tim Bastin

L3montree Cybersecurity

devguard-web

The documentation for the DevGuard Project

devguard-documentation

devguard-action

devguard

Manage your CVEs seamlessly, Integrate your Vulnerability Scanners, Documentation made easy, Compliance to security Frameworks - OWASP Incubating Project

Package	Max Risk	Total Risk	Flaw Count	Installed Version	Action
helm.sh/helm/v3	2.3	2.3	1	v3.15.3	No fix available
stdlib	1.3	4.7	4	1.22.5	Update to version 1.22.7 to reduce total risk by 4.7
github.com/open-policy-agent/opa	1.7	1.7	1	v0.66.0	Update to version 0.68.0 to reduce total risk by 1.7

L3montree Cybersecurity
Organization
/Devguard
Project
/devguard-scanner
Asset

Identified Risks