Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The sanitizeArchivePath function in pkg/extract/extract.go (lines 248–254) is vulnerable to a path traversal bypass due to a missing trailing path separator in the strings.HasPrefix check. A crafted tar archive can write files outside the intended destination directory when using the extractor CLI tool or the extract.DumpOTelCollector library function. Vulnerable Code File: pkg/extract/extract.go, lines 248–254 The function is called at line 219 inside untar, which is invoked by copyFromPod (line 205) during the Cold Extract data dump workflow. Root Cause strings.HasPrefix(v, filepath.Clean(d)) does not append a trailing / to the directory prefix, causing a directory name prefix collision. If the destination is /home/user/extract-output and a tar entry is named ../extract-outputevil/pwned, the joined path /home/user/extract-outputevil/pwned passes the prefix check — it starts with /home/user/extract-output — even though it is entirely outside the intended directory. Steps to…
Recommended action: Upgrade to 0.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Due to a mis-written NetworkPolicy, a malicious actor can pivot from a component to any other namespace. This breaks the security-by-default property expected as part of the deployment program, leading to a potential lateral movement. Patch Removing the inter-ns NetworkPolicy patches the vulnerability. If updates are not possible in production environments, we recommend to manually delete it and update as soon as possible. Workaround Given your context, delete the failing network policy that should be prefixed by inter-ns- in the monitoring namespace. You can use the following to delete all matching network policy. If unsure of the outcome, please do it manually.
Recommended action: Upgrade to 0.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.