Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Syft versions before v1.42.3 would not properly cleanup temporary storage if the temporary storage was exhausted during a scan. When scanning archives Syft will unpack those archives into temporary storage then inspect the unpacked contents. Under normal operation Syft will remove the temporary data it writes after completing a scan. This vulnerability would affect users of Syft that were scanning content that could cause Syft to fill the temporary storage that would then cause Syft to raise an error and exit. When the error is triggered Syft would exit without properly removing the temporary files in use. In our testing this was most easily reproduced by scanning very large artifacts or highly compressed artifacts such as a zipbomb. Because Syft would not clean up its temporary files, the result would be filling temporary file storage preventing future runs of Syft or other system utilities that rely on temporary storage being available. Patches The patch has been released in…
Recommended action: Upgrade to 1.42.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. Impact The SYFTATTESTPASSWORD environment variable is for the syft attest command to generate attested SBOMs for the given container image. This environment variable is used to decrypt the private key (provided with syft attest --key <path-to-key-file) during the signing process while generating an SBOM attestation. This vulnerability affects users running syft that have the SYFTATTESTPASSWORD environment variable set with credentials (regardless of if the attest command is being used or not). Users that do not have the environment variable SYFTATTESTPASSWORD set are not affected by this issue. The credentials are leaked in two ways: - in the syft logs when -vv or -vvv are used in the syft command (which is any log level = DEBUG) - in the attestation or SBOM only when the syft-json format is used Note that as of v0.69.0 any…
Recommended action: Upgrade to 0.70.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.