StackRadarChart IndexLive demo

CVE-2021-41106

Medium

Advisory

Published 29 Sept 2021In the index since 6 Sept 2026

Severity: Medium; worst across findings
CVSS: 4.4; base score, highest
EPSS: 0.002; 11th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 21; of 17,781 indexed, latest versions
Container images: 21; deployed by those charts
Fix available: 1 of 1; affected package

File reference keys leads to incorrect hashes on HMAC algorithms

Carried by container images the latest versions of 21 of 17,781 indexed charts deploy, on 21 images.

Affected package	Affected versions	Fixed in	Images
lcobucci/jwtcomposer	3.4.5, 4.1.4	3.4.6, 4.1.5	21

OSV records: GHSA-7322-jrq4-x5hf

Charts affected

21 by stars

Chart

Latest

Affected images

Radar Score

shlinkgeek-cookbook

1 of 1 See more

shlink geek-cookbook 5.2.0

1 of the 1 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
shlinkio/shlink :2.7.1	c6729db1d3a8	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

2,056

landelijketabellencataloguslandelijketabellencatalogus

1 of 3 See more

landelijketabellencatalogus landelijketabellencatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/landelijketabellencatalogus-php :latest	26d91dcbba56	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

waardepapieren-baliewaardepapieren-balie

1 of 3 See more

waardepapieren-balie waardepapieren-balie 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/waardepapieren-balie-php :latest	f36c423cd259	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,871

authorization-componentauthorization-component

1 of 3 See more

authorization-component authorization-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/authorization-component-php :latest	94a749392fcf	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,561

conduction-uiconduction-ui

1 of 6 See more

conduction-ui conduction-ui 0.1.0

1 of the 6 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
conduction/conduction-ui-php :dev	2744565516e8	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

12,907

eherkenning-uieherkenning-ui

1 of 3 See more

eherkenning-ui eherkenning-ui 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/eherkenning-ui-php :latest	deed102b4255	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

wallabaggeek-cookbook

1 of 1 See more

wallabag geek-cookbook 7.2.0

1 of the 1 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
wallabag/wallabag :2.4.2	5e4c26a7fb4a	lcobucci/jwt@3.4.5	3.4.6

Open the chart page →

4,358

grafregistratiecomponentgrafregistratiecomponent

1 of 3 See more

grafregistratiecomponent grafregistratiecomponent 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/grafregistratiecomponent-php :latest	35225eaa87ab	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

instemmingserviceinstemmingservice

1 of 3 See more

instemmingservice instemmingservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/instemmingservice-php :latest	4ffe222b3e3a	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

ocatiecataloguslocatiecatalogus

1 of 3 See more

ocatiecatalogus locatiecatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/ocatiecatalogus-php :latest	c22764cbfa97	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

loggingcomponentloggingcomponent

1 of 3 See more

loggingcomponent loggingcomponent 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/loggingcomponent-php :latest	834b8e1af290	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,492

memo-componentmemo-component

1 of 3 See more

memo-component memo-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/memo-component-php :latest	ef77f4c089a1	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

notification-componentnotification-component

1 of 4 See more

notification-component notification-component 1.0.0

1 of the 4 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/notification-component-php :latest	cd9656e6bc2c	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,527

orderregistratiecomponentorderregistratiecomponent

1 of 3 See more

orderregistratiecomponent orderregistratiecomponent 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/orderregistratiecomponent-php :latest	d17257e4fa27	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,492

productenendienstencatalogusproductenendienstencatalogus

1 of 3 See more

productenendienstencatalogus productenendienstencatalogus 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/productenendienstencatalogus-php :latest	7242da105081	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

proto-component-commongroundproto-component-commonground

1 of 3 See more

proto-component-commonground proto-component-commonground 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/proto-component-commonground-php :latest	eb36ead1954e	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

review-componentreview-component

1 of 3 See more

review-component review-component 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/review-component-php :latest	afe623824b82	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,491

taalhuizen-servicetaalhuizen-service

1 of 3 See more

taalhuizen-service taalhuizen-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,480

trouw-servicetrouw-service

1 of 3 See more

trouw-service trouw-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

verhuis-serviceverhuis-service

1 of 3 See more

verhuis-service verhuis-service 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,510

verzoekconversieserviceverzoekconversieservice

1 of 3 See more

verzoekconversieservice verzoekconversieservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2021-41106.

Container image	Digest	Package	Fixed in
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	lcobucci/jwt@4.1.4	4.1.5

Open the chart page →

7,528

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
conduction/conduction-ui-php :dev	2744565516e8	lcobucci/jwt@4.1.4	4.1.5	1
shlinkio/shlink :2.7.1	c6729db1d3a8	lcobucci/jwt@4.1.4	4.1.5	1
wallabag/wallabag :2.4.2	5e4c26a7fb4a	lcobucci/jwt@3.4.5	3.4.6	1
ghcr.io/conductionnl/authorization-component-php :latest	94a749392fcf	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/eherkenning-ui-php :latest	deed102b4255	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/grafregistratiecomponent-php :latest	35225eaa87ab	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/instemmingservice-php :latest	4ffe222b3e3a	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/landelijketabellencatalogus-php :latest	26d91dcbba56	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/loggingcomponent-php :latest	834b8e1af290	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/memo-component-php :latest	ef77f4c089a1	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/notification-component-php :latest	cd9656e6bc2c	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/ocatiecatalogus-php :latest	c22764cbfa97	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/orderregistratiecomponent-php :latest	d17257e4fa27	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/productenendienstencatalogus-php :latest	7242da105081	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/proto-component-commonground-php :latest	eb36ead1954e	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/review-component-php :latest	afe623824b82	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/taalhuizen-service-php :latest	04f1b7f0d573	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/trouw-service-php :latest	f745e2870692	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/verhuis-service-php :latest	66bbaf95a123	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/verzoekconversieservice-php :latest	e918014fb8d3	lcobucci/jwt@4.1.4	4.1.5	1
ghcr.io/conductionnl/waardepapieren-balie-php :latest	f36c423cd259	lcobucci/jwt@4.1.4	4.1.5	1