Go/github.com/tektoncd/pipeline CVE-2023-37264: low 3.7, EPSS 0.38%
Pipelines do not validate child UIDs
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.35.0 | - | 0.52.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-w2h3-vvvq-3m53
- https://github.com/tektoncd/pipeline/security/advisories/GHSA-w2h3-vvvq-3m53
- https://nvd.nist.gov/vuln/detail/CVE-2023-37264
- https://github.com/tektoncd/pipeline
- https://github.com/tektoncd/pipeline/blob/2d38f5fa840291395178422d34b36b1bc739e2a2/pkg/reconciler/pipelinerun/pipelinerun.go#L1358-L1372
- https://pkg.go.dev/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1#ChildStatusReference
CVE-2023-37264 · published · modified · JSON