Go/github.com/tektoncd/pipeline CVE-2023-37264: unknown, EPSS 0.38%
Pipelines do not validate child UIDs in github.com/tektoncd/pipeline
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.35.0 | - | - |
Fixed versions
No fixed version in the source.
Sources
- osv: GO-2023-1901
- https://github.com/tektoncd/pipeline/security/advisories/GHSA-w2h3-vvvq-3m53
- https://nvd.nist.gov/vuln/detail/CVE-2023-37264
- https://github.com/tektoncd/pipeline/blob/2d38f5fa840291395178422d34b36b1bc739e2a2/pkg/reconciler/pipelinerun/pipelinerun.go#L1358-L1372
- https://pkg.go.dev/github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1#ChildStatusReference
CVE-2023-37264 · published · modified · JSON