CVE-2022-40898

High

Advisory

Published 23 Dec 2022In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.027; 85th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 377; of 17,781 indexed, latest versions
Container images: 374; deployed by those charts
Fix available: 3 of 3; affected packages

pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)

Carried by container images the latest versions of 377 of 17,781 indexed charts deploy, on 374 images.

Affected package	Affected versions	Fixed in	Images
wheelpypi	0.29.0, 0.30.0, 0.31.0, 0.31.1+14 more	0.38.1	371
python-pipdeb	1.5.4-1ubuntu4, 8.1.1-2ubuntu0.4, 9.0.1-2.3~ubuntu1, 9.0.1-2.3~ubuntu1.18.04.1+8 more	1.5.4-1ubuntu4+esm3, 8.1.1-2ubuntu0.6+esm4, 9.0.1-2.3~ubuntu1.18.04.7, 20.0.2-5ubuntu1.8+1 more	53
wheeldeb	0.29.0-1, 0.30.0-0.2, 0.34.2-1, 0.37.1-2	0.29.0-1ubuntu0.1~esm1, 0.30.0-0.2ubuntu0.1, 0.34.2-1ubuntu0.1, 0.37.1-2ubuntu0.22.04.1	46

OSV records: GHSA-qwmp-2cf2-g9g6 UBUNTU-CVE-2022-40898
Also known as: PYSEC-2022-43017, USN-5821-1, USN-5821-2, USN-5821-3

Charts affected

377 by stars

Chart

Latest

Affected images

Radar Score

prometheus-operatorstatcan

0.2.2

1 of 7 See more

prometheus-operator statcan 0.2.2

1 of the 7 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.151	7b98eecdf6d1	wheel@0.34.2	0.38.1

Open the chart page →

12,237

sn-platform-slimstreamnative

1.11.44

1 of 6 See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
streamnative/apache-pulsar-grafana-dashboard-k8s :0.1.2	0e6d7aa3ef32	wheel@0.34.2	0.38.1

Open the chart page →

10,134

studygovernorstudy-governor

0.1.38

1 of 3 See more

studygovernor study-governor 0.1.38

1 of the 3 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	wheel@0.37.1	0.38.1

Open the chart page →

1,447

csv-viewsvtech-public-helm-charts

1.0.0

1 of 1 See more

csv-view svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_csv :v1.0.1	b9d7ecf8de24	wheel@0.34.2	0.38.1

Open the chart page →

1,220

icinga2svtech-public-helm-charts

1.0.0

1 of 4 See more

icinga2 svtech-public-helm-charts 1.0.0

1 of the 4 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_icinga2 :v1.1.6	67be2aba9436	wheel@0.36.2	0.38.1

Open the chart page →

5,511

icinga2-reportsvtech-public-helm-charts

1.0.0

1 of 1 See more

icinga2-report svtech-public-helm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
trungkien210493/icinga2-report :v1.7.1	2cc8c3763c4c	wheel@0.34.2	0.38.1

Open the chart page →

1,779

rundecksvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck :v1.2.2	6e368ace0977	wheel@0.37.1	0.38.1

Open the chart page →

18,756

rundeck-option-providersvtech-public-helm-charts

1.0.0

1 of 2 See more

rundeck-option-provider svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
svtechnmaa/svtech_rundeck_option_provider :v1.1.1	674fad30a51f	wheel@0.34.2	0.38.1

Open the chart page →

1,428

gtmetrix-bqt3n

1.0.0

1 of 1 See more

gtmetrix-bq t3n 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
t3nde/gtmetrix-bq :0.2.0	d2939e9a719b	wheel@0.34.2	0.38.1

Open the chart page →

1,287

take-the-helmtake-the-helm

0.1.0

1 of 1 See more

take-the-helm take-the-helm 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
cadmusthefounder/lnd :take-the-helm-0.1.0	e596c5fbf80f	wheel@0.37.1	0.38.1

Open the chart page →

805

tensor_apptensor-app

0.2.2

1 of 3 See more

tensor_app tensor-app 0.2.2

1 of the 3 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
xeladock/mysql_dns :latest	4baf531453f1	python-pip@22.0.2+dfsg-1 wheel@0.37.1-2 wheel@0.37.1	22.0.2+dfsg-1ubuntu0.2 0.37.1-2ubuntu0.22.04.1 0.38.1

Open the chart page →

17,461

krokiteochenglim

1.0.1

1 of 5 See more

kroki teochenglim 1.0.1

1 of the 5 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
yuzutech/kroki-blockdiag :0.16.0	7c1917c66d96	wheel@0.37.0	0.38.1

Open the chart page →

8,715

webapp1test-helm-chart-1

0.1.0

1 of 1 See more

webapp1 test-helm-chart-1 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
devopsjourney1/mywebapp :latest	bd1ec6838570	wheel@0.37.1	0.38.1

Open the chart page →

1,469

tezos-nodetezos-node

1.0.0

1 of 4 See more

tezos-node tezos-node 1.0.0

1 of the 4 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
oxheadalpha/tezos-k8s-utils :5.3.4	d9faed45bf1c	wheel@0.37.0	0.38.1

Open the chart page →

5,321

monitoringthl-charts

0.1.1

1 of 10 See more

monitoring thl-charts 0.1.1

1 of the 10 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
quay.io/kiwigrid/k8s-sidecar :1.15.6	1f025ae37b7b	wheel@0.37.1	0.38.1

Open the chart page →

18,908

jenkinstnh

2.7.1

1 of 2 See more

jenkins tnh 2.7.1

1 of the 2 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
kiwigrid/k8s-sidecar :0.1.193	170069ff0976	wheel@0.35.1	0.38.1

Open the chart page →

4,423

test0tohlejezkouska

0.1.0

1 of 2 See more

test0 tohlejezkouska 0.1.0

1 of the 2 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
devopsjourney1/mywebapp :latest	bd1ec6838570	wheel@0.37.1	0.38.1

Open the chart page →

3,296

jupyterhubuninettsigma2

1.6.0

1 of 5 See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
quay.io/nird-toolkit/jupyterhub-server :20221215-e6aa80e	cae8c0622533	wheel@0.37.1	0.38.1

Open the chart page →

8,607

unmanicvhdirk

0.1.4

1 of 1 See more

9,347

vinyl-lib-chartvinyl-lib

0.1.0

1 of 1 See more

vinyl-lib-chart vinyl-lib 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
kporwit/vinyl_lib_app :v0.1.1	217de0302218	wheel@0.37.1	0.38.1

Open the chart page →

3,392

wazuh-manager-filebeatwazuh-manager-filebeat

0.1.0-gamma

1 of 1 See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	wheel@0.34.2	0.38.1

Open the chart page →

11,119

weather-chartweather-web-app

0.1.0

1 of 1 See more

weather-chart weather-web-app 0.1.0

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
zohardocker12/weather_app_flask :latest	b86d60dbb68d	wheel@0.37.1	0.38.1

Open the chart page →

2,670

webapp-chartwebappchart

1.0.0

1 of 1 See more

webapp-chart webappchart 1.0.0

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
amagdi888/my-repo :hello-app	d8a10fc8faf6	wheel@0.37.1	0.38.1

Open the chart page →

1,201

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
temporalio/admin-tools :1.15.1	35034611d981	wheel@0.37.0	0.38.1

Open the chart page →

22,665

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	wheel@0.36.2	0.38.1

Open the chart page →

1,843

alertmanager-matrix-forwarderzloi-space

1.0.1

1 of 2 See more

alertmanager-matrix-forwarder zloi-space 1.0.1

1 of the 2 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	wheel@0.37.1	0.38.1

Open the chart page →

3,118

grafana-matrix-forwarderzloi-space

1.0.0

1 of 2 See more

grafana-matrix-forwarder zloi-space 1.0.0

1 of the 2 container images this version deploys carry CVE-2022-40898.

Container image	Digest	Package	Fixed in
matrixdotorg/pantalaimon :v0.10.4	ba6a587fa508	wheel@0.37.1	0.38.1

Open the chart page →

1,636

Container images carrying it

374 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
hjacobs/kube-web-view :20.10.0	b44a9cf81a2f	wheel@0.35.1	0.38.1	1
hkotel/mealie :api-v1.0.0beta-2	a7e6b6abe087	wheel@0.37.1	0.38.1	1
hmdmph/mongo-pod-labeler :1.0.1-alpine	79e4a170f3dc	wheel@0.33.1	0.38.1	1
hmdmph/redis-pod-labeler :1.0.0-alpine	7f1381fe0f3b	wheel@0.34.2	0.38.1	1
ihatemoney/ihatemoney :5.2.0	457fda1feb32	wheel@0.37.1	0.38.1	1
improwised/erpnext-worker :v13.4.1	97280b55cbd4	wheel@0.36.2	0.38.1	1
intel/dlstreamer-pipeline-server :2022.1.1-ubuntu20	aa8f5483a2ef	python-pip@20.0.2-5ubuntu1.6 wheel@0.34.2-1 wheel@0.34.2	20.0.2-5ubuntu1.8 0.34.2-1ubuntu0.1 0.38.1	1
iosifache/wazuh-manager-filebeat :latest	85df3f04b5da	wheel@0.34.2	0.38.1	1
irakli/ms-hello-python :latest	9e7a91ba9ae0	wheel@0.37.1	0.38.1	1
istio/examples-bookinfo-productpage-v1 :1.17.0	6668bcf42ef0	wheel@0.34.2	0.38.1	1
jakuboskera/guestbook :v0.3.0	4989afa06e74	wheel@0.37.0	0.38.1	1
jakuboskera/todo :v0.2.3	714b1adbbc2d	wheel@0.37.1	0.38.1	1
jertel/elastalert2 :2.2.3	4dcc0ef93efc	wheel@0.37.0	0.38.1	1
jmferrer/azure-devops-agent :latest	030f68ec6998	wheel@0.30.0	0.38.1	1
josh5/unmanic :0.2.6	4d49c4816260	wheel@0.37.1	0.38.1	1
julb/alertmanager-gchat-integration :1.0.5	837c4038a0dd	wheel@0.36.2	0.38.1	1
julb/http-reqtrace :1.1.0	0806409af397	wheel@0.35.1	0.38.1	1
julb/kubernetes-configmap-sync :1.1.0	d7d8836366ad	wheel@0.35.1	0.38.1	1
jupyterhub/k8s-hub :0.11.1	b6b4a1a34bf0	python-pip@20.0.2-5ubuntu1.1 wheel@0.34.2-1 wheel@0.34.2	20.0.2-5ubuntu1.8 0.34.2-1ubuntu0.1 0.38.1	1
jupyterhub/k8s-hub :1.2.0	e4770285aaf7	python-pip@20.0.2-5ubuntu1.6 wheel@0.34.2-1 wheel@0.34.2	20.0.2-5ubuntu1.8 0.34.2-1ubuntu0.1 0.38.1	1
jupyterhub/k8s-singleuser-sample :0.11.1	e3e6f3051df8	wheel@0.35.1	0.38.1	1
jvstein/bitcoin-prometheus-exporter :v0.5.0	7cc385d038b1	wheel@0.34.2	0.38.1	1
keitaro/ckan-datapusher :0.0.17	5bf1a45f45c1	wheel@0.35.1	0.38.1	1
kelvinsp/mlflow :1.26.1	cd33e6db2a59	wheel@0.36.2	0.38.1	1
kennethreitz/httpbin :latest	599fe5e50731	python-pip@9.0.1-2.3~ubuntu1 wheel@0.30.0-0.2 wheel@0.30.0	9.0.1-2.3~ubuntu1.18.04.7 0.30.0-0.2ubuntu0.1 0.38.1	1
kfirfer/kibana-index-pattern-updater :1.0.12	e88cfcec5c93	wheel@0.36.2	0.38.1	1
kfirfer/percona-xtradb-healthcheck :0.0.1	ef7b909a8e6b	wheel@0.35.1	0.38.1	1
kfserving/models-web-app :v0.6.1	f322d6ffdfa3	wheel@0.37.0	0.38.1	1
kiwigrid/k8s-sidecar :1.1.0	3e86186656d3	wheel@0.35.1	0.38.1	1
kiwigrid/k8s-sidecar :1.3.0	65095a82d4a1	wheel@0.35.1	0.38.1	1
kiwigrid/k8s-sidecar :0.0.18	6eb52513d59e	wheel@0.33.4	0.38.1	1
kiwigrid/k8s-sidecar :1.12.0	89739be9ff38	wheel@0.36.2	0.38.1	1
kiwigrid/k8s-sidecar :0.0.16	899ccd0b1f54	wheel@0.33.1	0.38.1	1
kiwigrid/k8s-sidecar :0.1.20	af151f677a63	wheel@0.33.4	0.38.1	1
kobotoolbox/kobocat :2.022.24a	b15679454415	wheel@0.37.1	0.38.1	1
kobotoolbox/kpi :2.022.24d	bcacc01bccd4	wheel@0.37.1	0.38.1	1
kocolosk/couchdb-statefulset-assembler :1.2.0	6effb982154e	wheel@0.30.0	0.38.1	1
kodekloud/webapp-color :latest	99c3821ea49b	wheel@0.32.1	0.38.1	1
kong/httpbin :latest	a6ac46531193	wheel@0.37.1	0.38.1	1
kporwit/vinyl_lib_app :v0.1.1	217de0302218	wheel@0.37.1	0.38.1	1
kserve/models-web-app :v0.8.0	63ea05e73842	wheel@0.37.1	0.38.1	1
kubeaws/kube-spot-termination-notice-handler :1.13.0-1	c9cd2ba4373a	wheel@0.33.1	0.38.1	1
kubeflownotebookswg/jupyter-web-app :v1.6.1	d762690e21c1	wheel@0.37.1	0.38.1	1
kubeflownotebookswg/tensorboards-web-app :v1.6.1	0876fef1973b	wheel@0.37.1	0.38.1	1
kubeflownotebookswg/volumes-web-app :v1.6.1	7299fa94db15	wheel@0.37.1	0.38.1	1
kubesphere/examples-bookinfo-productpage-v1 :1.13.0	378f49ec9c44	wheel@0.33.1	0.38.1	1
kubitodev/traefik-ip-whitelist-sync :1.0.2	aa24869319bf	wheel@0.37.1	0.38.1	1
kunchalavikram/connectedcity :v1	4a559a47579e	wheel@0.32.3	0.38.1	1
kunchalavikram/connectedfactory :v1	52c13fb9b1d9	wheel@0.32.3	0.38.1	1
kusionstack/kusion :v0.14.0	126c8f0b0976	wheel@0.37.1	0.38.1	1