CVE-2023-29491

High

Advisory

Published 14 Apr 2023In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.8; base score, highest
EPSS: 0.009; 58th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 854; of 17,787 indexed, latest versions
Container images: 810; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: ncurses security update

Carried by container images the latest versions of 854 of 17,787 indexed charts deploy, on 810 images.

Affected package	Affected versions	Fixed in	Images
ncursesdeb	5.9+20140118-1ubuntu1, 6.0+20160213-1ubuntu1, 6.1-1ubuntu1, 6.1-1ubuntu1.18.04+2 more	5.9+20140118-1ubuntu1+esm3, 6.0+20160213-1ubuntu1+esm3, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1+1 more	443
ncursesapk	6.3_p20211120-r0, 6.3_p20211120-r1, 6.3_p20220423-r0, 6.3_p20220521-r0+1 more	6.3_p20211120-r2, 6.3_p20220521-r1, 6.3_p20221119-r1	206
ncursesrpm	6.1-7.20180224.el8, 6.1-9.20180224.el8, 6.1-9.20180224.el8_6.1, 6.1-150000.5.12.1+1 more	0:6.1-9.20180224.el8_8.1, 0:6.2-10.20210508.el9, 6.1-150000.5.15.1	161

OSV records: ALPINE-CVE-2023-29491 RHSA-2023:5249 RHSA-2023:6698 UBUNTU-CVE-2023-29491 SUSE-SU-2023:2111-1
Also known as: RHSA-2023:7361, RHSA-2024:0416, USN-6099-1

Charts affected

854 by stars

Chart

Latest

Affected images

Radar Score

zahori-serverzahori

1.0.1

1 of 2 See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2023-29491.

Container image	Digest	Package	Fixed in
flyway/flyway :9.14.1-alpine	80f12c80502b	ncurses@6.3_p20221119-r0	6.3_p20221119-r1

Open the chart page →

5,847

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-29491.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	ncurses@6.1-9.20180224.el8	0:6.1-9.20180224.el8_8.1

Open the chart page →

6,016

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2023-29491.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	ncurses@6.1-9.20180224.el8	0:6.1-9.20180224.el8_8.1

Open the chart page →

3,697

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2023-29491.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	ncurses@6.1-1ubuntu1.18.04	6.1-1ubuntu1.18.04.1
yandex/clickhouse-server :21.3.20	4eccfffb01d7	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1

Open the chart page →

9,250

Container images carrying it

810 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/ctron/streamsheets-service-graphs :2.4.0	e34964e336c1	ncurses@6.1-7.20180224.el8	0:6.1-9.20180224.el8_8.1	1
ghcr.io/ctron/streamsheets-service-machines :2.4.0	0c5a3398d1e4	ncurses@6.1-7.20180224.el8	0:6.1-9.20180224.el8_8.1	1
ghcr.io/ctron/streamsheets-service-streams :2.4.0	8ba040e79ca0	ncurses@6.1-7.20180224.el8	0:6.1-9.20180224.el8_8.1	1
ghcr.io/daocloud/dao-2048 :v1.4.1	21275bc02f75	ncurses@6.3_p20221119-r0	6.3_p20221119-r1	1
ghcr.io/data-fair/elasticsearch :7.17.1	aa45adaf59a7	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/dodevops/azure-advanced-backup :0.4.0	1041d4449e49	ncurses@6.3_p20220521-r0	6.3_p20220521-r1	1
ghcr.io/dodevops/scalyr-k8snode-manager :latest	fc39fcdd3968	ncurses@6.3_p20211120-r0	6.3_p20211120-r2	1
ghcr.io/drogue-iot/authentication-service :0.11.0	857b137fc7b3	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/coap-endpoint :0.11.0	44790b71aa22	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/command-endpoint :0.11.0	6dce3158b851	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/console-backend :0.11.0	25d229ae5bde	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/console-frontend :0.11.0	558972f9374c	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/database-migration :0.11.0	57072c72a7cd	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/device-management-controller :0.11.0	200aea1a2b42	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/device-management-service :0.11.0	f4a5bfc06a74	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/device-state-service :0.11.0	fbf0738cfc7e	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/drogue-event-source :0.2.1	e2e812a4cf8e	ncurses@6.1-9.20180224.el8	0:6.1-9.20180224.el8_8.1	1
ghcr.io/drogue-iot/http-endpoint :0.11.0	b612c18479e0	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/knative-operator :0.11.0	e2d927639f6e	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/mqtt-endpoint :0.11.0	32c6d2f5eab9	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/mqtt-integration :0.11.0	7ac2adb6ca49	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/outbox-controller :0.11.0	1a958edafdb1	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/postgresql-pusher :0.2.1	c6bb121ced90	ncurses@6.1-9.20180224.el8	0:6.1-9.20180224.el8_8.1	1
ghcr.io/drogue-iot/test-cert-generator :0.11.0	6ba7e1608286	ncurses@6.1-9.20180224.el8	0:6.1-9.20180224.el8_8.1	1
ghcr.io/drogue-iot/topic-strimzi-operator :0.11.0	5253fbf8d04c	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/ttn-operator :0.11.0	7dd5ac80c8f1	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/user-auth-service :0.11.0	adebc40ddf98	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/drogue-iot/websocket-integration :0.11.0	372dcd370945	ncurses@6.2-8.20210508.el9	0:6.2-10.20210508.el9	1
ghcr.io/edgelesssys/coordinator :v0.5.0	bcd5b8d4c45c	ncurses@6.1-1ubuntu1.18.04	6.1-1ubuntu1.18.04.1	1
ghcr.io/edgelesssys/edgelessdb-sgx-1gb :v0.3.2	7e1d7a11a11a	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/epinio/epinio-ui :v1.7.1-0.0.1	d3de52dfb0b4	ncurses@6.1-150000.5.12.1	6.1-150000.5.15.1	1
ghcr.io/eugenmayer/nist-data-mirror :0.1.1	a2162df94729	ncurses@6.3_p20221119-r0	6.3_p20221119-r1	1
ghcr.io/ferama/vipien :v0.5.3	923a3f704b21	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/fernferret/mediawiki-backup :v0.2.2	bbef381294ed	ncurses@6.3_p20220521-r0	6.3_p20220521-r1	1
ghcr.io/formancehq/ledger :v1.9.2	03c1ddbda33b	ncurses@6.3-2	6.3-2ubuntu0.1	1
ghcr.io/haveagitgat/tdarr :2.00.18.2	3fbe4c29d14c	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/jenkins-x/nexus :0.1.37	8caf5289fe73	ncurses@6.1-7.20180224.el8	0:6.1-9.20180224.el8_8.1	1
ghcr.io/jr0dd/puppeteer :v13.3.2	6047599cd78e	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/apache-musicindex :v1.4.1-2	c9bd82dc5fda	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/bazarr :v1.0.3	fdb5501cdfb9	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/emby :v4.6.1.0	5c6b8f91f1c4	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/haste-server :latest	827aa2f2389d	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/jackett :v0.20.1316	3a4715b46aa2	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/lidarr :v1.0.0.2255	54ebc1f90963	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/network-ups-tools :v2.7.4-2479-g86a32237	cbd5d4cc1245	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/nzbget :v21.1	e5571acd10ce	ncurses@6.3-2	6.3-2ubuntu0.1	1
ghcr.io/k8s-at-home/nzbhydra2 :v3.14.2	ef3670f7e0a8	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/plex :v1.28.0.5999-97678ded3	ef756c7d784b	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
ghcr.io/k8s-at-home/pod-gateway :v1.6.1	dcb2d814a4f7	ncurses@6.3_p20220521-r0	6.3_p20220521-r1	1
ghcr.io/k8s-at-home/prowlarr :v0.3.0.1710	c863aa9875fa	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1