VDB
GHSA-29WX-VH33-7X7R
GHSA-29WX-VH33-7X7R
PUBLISHED
CVSS 3.0999999046325684 LOW
Record from GitHub Advisory Database · Published November 4, 2024
Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| terraform-provider-azurerm | Chainguard | 4.8.0-r1 |
| harbor-fips-2.9 | Chainguard | 2.9.5-r5 |
| flux-source-controller-fips | Chainguard | 1.4.1-r1 |
| terraform | Wolfi | 1.5.7-r36 |
| tkn-fips | Chainguard | 0.38.1-r1 |
| grafana-fips-10.4 | Chainguard | 10.4.11-r1 |
| cluster-autoscaler-fips-1.29 | Chainguard | 1.29.4-r2 |
| promxy | Wolfi | 0.0.91-r1 |
| azure-aad-pod-identity-mic | Chainguard | 1.8.17-r13 |
| gitlab-runner-fips-17.2 | Chainguard | 17.2.3-r1 |
| opentofu-1.8 | Chainguard | 1.8.5-r1 |
| secrets-store-csi-driver-provider-azure | Chainguard | 1.6.0-r1 |
88 more packages have a fixed version. See every fix in Lookup.
Risk scores
CVSS 3.1
3.0999999046325684
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | terraform-provider-azurerm | 0 |
| chainguard | harbor-fips-2.9 | 0 |
| chainguard | flux-source-controller-fips | 0 |
| wolfi | terraform | 0 |
| chainguard | tkn-fips | 0 |
| chainguard | grafana-fips-10.4 | 0 |
| chainguard | cluster-autoscaler-fips-1.29 | 0 |
| wolfi | promxy | 0 |
| chainguard | azure-aad-pod-identity-mic | 0 |
| chainguard | gitlab-runner-fips-17.2 | 0 |
| chainguard | opentofu-1.8 | 0 |
| chainguard | secrets-store-csi-driver-provider-azure | 0 |
| chainguard | minio-operator-fips | 0 |
| chainguard | azuredisk-csi-fips-1.29 | 0 |
| chainguard | opentelemetry-collector-contrib | 0 |
| chainguard | coredns-fips | 0 |
| wolfi | chartmuseum | 0 |
| chainguard | tkn | 0 |
| chainguard | eks-distro-fips-1.27 | 0 |
| wolfi | cosign | 0 |
…and 339 more
Timeline
- Nov 4, 2024 CVE Published
- Apr 29, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-29WX-VH33-7X7R
vulnetix vdb fixes GHSA-29WX-VH33-7X7ROr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-29WX-VH33-7X7R/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart