CVE-2019-11840

Medium

Advisory

Published 24 May 2022In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 5.9; base score, highest
EPSS: 0.035; 88th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 23; of 17,781 indexed, latest versions
Container images: 19; deployed by those charts
Fix available: 1 of 1; affected package

golang.org/x/crypto/salsa20/salsa uses insufficiently random values

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 19 images.

Affected package	Affected versions	Fixed in	Images
golang.org/x/cryptogolang	v0.0.0-20180808211826-de0752318171, v0.0.0-20181025213731-e84da0312774, v0.0.0-20181029021203-45a5f77698d3, v0.0.0-20181203042331-505ab145d0a9+1 more	0.0.0-20190320223903-b7391e95e576	19

OSV records: GHSA-r5c5-pr8j-pfp7
Also known as: GO-2022-0209

Charts affected

23 by stars

Chart

Latest

Affected images

Radar Score

kube-prometheuschoerodon

9.3.1

1 of 7 See more

kube-prometheus choerodon 9.3.1

1 of the 7 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
jettech/kube-webhook-certgen :v1.2.1	c42098c8d855	golang.org/x/crypto@v0.0.0-20181203042331-505ab145d0a9	0.0.0-20190320223903-b7391e95e576

Open the chart page →

12,237

dex-k8s-authenticatorsagikazarmark

0.0.3

1 of 1 See more

dex-k8s-authenticator sagikazarmark 0.0.3

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

2,791

weblatedeliveryhero

0.3.2

1 of 3 See more

weblate deliveryhero 0.3.2

1 of the 3 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

7,984

alertmanager-botgeek-cookbook

6.4.2

1 of 1 See more

alertmanager-bot geek-cookbook 6.4.2

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
metalmatze/alertmanager-bot :0.4.3	426bc2ca7586	golang.org/x/crypto@v0.0.0-20181029021203-45a5f77698d3	0.0.0-20190320223903-b7391e95e576

Open the chart page →

3,586

rke2-canalrke2-charts

3.13.3

1 of 2 See more

rke2-canal rke2-charts 3.13.3

1 of the 2 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
rancher/hardened-flannel :v0.13.0-rancher1	42784bb38ed3	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

6,996

gcp-quota-exportersoftonic

2.0.2

1 of 1 See more

gcp-quota-exporter softonic 2.0.2

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
mintel/gcp-quota-exporter :v0.3.2	0e0707b7732b	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

2,637

frpswenerme

1.0.1

1 of 1 See more

frps wenerme 1.0.1

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
wener/frps :v0.37.0	5c92cc9e8597	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

3,359

notebook-controllercowboysysop

1.1.2

1 of 1 See more

notebook-controller cowboysysop 1.1.2

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
public.ecr.aws/j1r0q0g6/notebooks/notebook-controller :v1.4	cac3ed9a9826	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

2,582

mongodb-bi-connectordasmeta

1.0.3

1 of 1 See more

mongodb-bi-connector dasmeta 1.0.3

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
dasmeta/mongodb-bi-connector :1.0.3	fa657960dfec	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

5,832

drone-kubernetes-secretsdrone

0.1.4

1 of 1 See more

drone-kubernetes-secrets drone 0.1.4

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
drone/kubernetes-secrets :latest	206df2280ecf	golang.org/x/crypto@v0.0.0-20180808211826-de0752318171	0.0.0-20190320223903-b7391e95e576

Open the chart page →

2,760

commentoduyet

0.2.0

1 of 2 See more

commento duyet 0.2.0

1 of the 2 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
registry.gitlab.com/commento/commento :v1.8.0	e0ab1fc86761	golang.org/x/crypto@v0.0.0-20180808211826-de0752318171	0.0.0-20190320223903-b7391e95e576

Open the chart page →

2,679

weblatehelm-charts-nr

0.3.2

1 of 3 See more

weblate helm-charts-nr 0.3.2

1 of the 3 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
weblate/weblate :4.2.2-1	69c160d37a3c	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

7,984

dex-k8s-authenticatorkfirfer

0.0.3

1 of 1 See more

dex-k8s-authenticator kfirfer 0.0.3

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

2,791

flaggermesosphere

0.21.0

1 of 2 See more

flagger mesosphere 0.21.0

1 of the 2 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
weaveworks/flagger :0.19.0	a9c2e9df4227	golang.org/x/crypto@v0.0.0-20181025213731-e84da0312774	0.0.0-20190320223903-b7391e95e576

Open the chart page →

6,048

kommandermesosphere-stable

0.39.2

1 of 29 See more

kommander mesosphere-stable 0.39.2

1 of the 29 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
gcr.io/kubecost1/server :prod-1.81.0	a348db3e4d74	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

68,284

oauth2-proxypresto-loadbalancer

4.3.18

1 of 2 See more

oauth2-proxy presto-loadbalancer 4.3.18

1 of the 2 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v6.1.1	791aef35b8d1	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

3,958

reportportalreportportal

5.7.2

1 of 8 See more

reportportal reportportal 5.7.2

1 of the 8 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
reportportal/service-index :5.0.11	2b27a2d7a87d	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

25,737

weblateslamdev

0.0.11

1 of 2 See more

weblate slamdev 0.0.11

1 of the 2 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
weblate/weblate :3.11.3-1	82848df56ecd	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

8,694

cost-analyzerstatcan

1.82.2

1 of 9 See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
gcr.io/kubecost1/server :prod-1.82.2	2b1a3d08caac	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

16,506

prometheus-operatorstatcan

0.2.2

1 of 7 See more

prometheus-operator statcan 0.2.2

1 of the 7 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
jettech/kube-webhook-certgen :v1.2.1	c42098c8d855	golang.org/x/crypto@v0.0.0-20181203042331-505ab145d0a9	0.0.0-20190320223903-b7391e95e576

Open the chart page →

12,237

frpcwenerme

1.0.1

1 of 1 See more

frpc wenerme 1.0.1

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
wener/frpc :v0.37.0	cc9fd4da44c0	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

3,359

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
prom/prometheus :v2.16.0	e4ca62c0d62f	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

22,665

dex-k8s-authenticatorwiremind

1.7.0

1 of 1 See more

dex-k8s-authenticator wiremind 1.7.0

1 of the 1 container images this version deploys carry CVE-2019-11840.

Container image	Digest	Package	Fixed in
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576

Open the chart page →

2,791

Container images carrying it

19 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
mintel/dex-k8s-authenticator :1.4.0	caf71cee7b9a	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	3
jettech/kube-webhook-certgen :v1.2.1	c42098c8d855	golang.org/x/crypto@v0.0.0-20181203042331-505ab145d0a9	0.0.0-20190320223903-b7391e95e576	2
weblate/weblate :4.2.2-1	69c160d37a3c	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	2
dasmeta/mongodb-bi-connector :1.0.3	fa657960dfec	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
drone/kubernetes-secrets :latest	206df2280ecf	golang.org/x/crypto@v0.0.0-20180808211826-de0752318171	0.0.0-20190320223903-b7391e95e576	1
metalmatze/alertmanager-bot :0.4.3	426bc2ca7586	golang.org/x/crypto@v0.0.0-20181029021203-45a5f77698d3	0.0.0-20190320223903-b7391e95e576	1
mintel/gcp-quota-exporter :v0.3.2	0e0707b7732b	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
prom/prometheus :v2.16.0	e4ca62c0d62f	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
rancher/hardened-flannel :v0.13.0-rancher1	42784bb38ed3	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
reportportal/service-index :5.0.11	2b27a2d7a87d	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
weaveworks/flagger :0.19.0	a9c2e9df4227	golang.org/x/crypto@v0.0.0-20181025213731-e84da0312774	0.0.0-20190320223903-b7391e95e576	1
weblate/weblate :3.11.3-1	82848df56ecd	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
wener/frpc :v0.37.0	cc9fd4da44c0	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
wener/frps :v0.37.0	5c92cc9e8597	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
gcr.io/kubecost1/server :prod-1.82.2	2b1a3d08caac	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
gcr.io/kubecost1/server :prod-1.81.0	a348db3e4d74	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
public.ecr.aws/j1r0q0g6/notebooks/notebook-controller :v1.4	cac3ed9a9826	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
quay.io/oauth2-proxy/oauth2-proxy :v6.1.1	791aef35b8d1	golang.org/x/crypto@v0.0.0-20190308221718-c2843e01d9a2	0.0.0-20190320223903-b7391e95e576	1
registry.gitlab.com/commento/commento :v1.8.0	e0ab1fc86761	golang.org/x/crypto@v0.0.0-20180808211826-de0752318171	0.0.0-20190320223903-b7391e95e576	1