Go/github.com/oam-dev/kubevela CVE-2022-39383: medium 4.9, EPSS 0.42%
KubeVela VelaUX APIserver has SSRF vulnerability
Action: Upgrade github.com/oam-dev/kubevela to 1.5.9 or later.
go get github.com/oam-dev/kubevela@v1.6.2go get github.com/oam-dev/kubevela@v1.5.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.6.0-alpha.1 | 1.6.2 | - |
| 0 | 1.5.9 | - |
Fixed versions
| 1.6.2 | 1.5.9 |
Sources
- osv: GHSA-m5xf-x7q6-3rm7
- https://github.com/kubevela/kubevela/security/advisories/GHSA-m5xf-x7q6-3rm7
- https://nvd.nist.gov/vuln/detail/CVE-2022-39383
- https://github.com/kubevela/kubevela/pull/5000
- https://github.com/kubevela/kubevela
- https://pkg.go.dev/vuln/GO-2022-1113
CVE-2022-39383 · published · modified · JSON