CVE-2023-29491

High

Advisory

Published 14 Apr 2023In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.8; base score, highest
EPSS: 0.009; 58th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 854; of 17,787 indexed, latest versions
Container images: 810; deployed by those charts
Fix available: 3 of 3; affected packages

Red Hat Security Advisory: ncurses security update

Carried by container images the latest versions of 854 of 17,787 indexed charts deploy, on 810 images.

Affected package	Affected versions	Fixed in	Images
ncursesdeb	5.9+20140118-1ubuntu1, 6.0+20160213-1ubuntu1, 6.1-1ubuntu1, 6.1-1ubuntu1.18.04+2 more	5.9+20140118-1ubuntu1+esm3, 6.0+20160213-1ubuntu1+esm3, 6.1-1ubuntu1.18.04.1, 6.2-0ubuntu2.1+1 more	443
ncursesapk	6.3_p20211120-r0, 6.3_p20211120-r1, 6.3_p20220423-r0, 6.3_p20220521-r0+1 more	6.3_p20211120-r2, 6.3_p20220521-r1, 6.3_p20221119-r1	206
ncursesrpm	6.1-7.20180224.el8, 6.1-9.20180224.el8, 6.1-9.20180224.el8_6.1, 6.1-150000.5.12.1+1 more	0:6.1-9.20180224.el8_8.1, 0:6.2-10.20210508.el9, 6.1-150000.5.15.1	161

OSV records: ALPINE-CVE-2023-29491 RHSA-2023:5249 RHSA-2023:6698 UBUNTU-CVE-2023-29491 SUSE-SU-2023:2111-1
Also known as: RHSA-2023:7361, RHSA-2024:0416, USN-6099-1

Charts affected

854 by stars

Chart

Latest

Affected images

Radar Score

zahori-serverzahori

1.0.1

1 of 2 See more

zahori-server zahori 1.0.1

1 of the 2 container images this version deploys carry CVE-2023-29491.

Container image	Digest	Package	Fixed in
flyway/flyway :9.14.1-alpine	80f12c80502b	ncurses@6.3_p20221119-r0	6.3_p20221119-r1

Open the chart page →

5,847

keycloakxzaks

2.2.0

1 of 1 See more

keycloakx zaks 2.2.0

1 of the 1 container images this version deploys carry CVE-2023-29491.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	ncurses@6.1-9.20180224.el8	0:6.1-9.20180224.el8_8.1

Open the chart page →

6,016

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2023-29491.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	ncurses@6.1-9.20180224.el8	0:6.1-9.20180224.el8_8.1

Open the chart page →

3,697

clickhousezloi-space

1.2.0

2 of 3 See more

clickhouse zloi-space 1.2.0

2 of the 3 container images this version deploys carry CVE-2023-29491.

Container image	Digest	Package	Fixed in
yandex/clickhouse-client :21.3	863f94a0f607	ncurses@6.1-1ubuntu1.18.04	6.1-1ubuntu1.18.04.1
yandex/clickhouse-server :21.3.20	4eccfffb01d7	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1

Open the chart page →

9,250

Container images carrying it

810 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/mongodb :4.4.5	cf72810d33f5	ncurses@6.1-7.20180224.el8	0:6.1-9.20180224.el8_8.1	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	ncurses@6.1-9.20180224.el8	0:6.1-9.20180224.el8_8.1	1
registry.gitlab.com/infinitydon/registry/open5gs-aio :v2.2.2	f6385712935f	ncurses@6.2-0ubuntu2	6.2-0ubuntu2.1	1
registry.gitlab.com/purelb/purelb/allocator :v0.0.0-106-ipv6-lbip-052cedab	9d1fcb78f529	ncurses@6.1-9.20180224.el8	0:6.1-9.20180224.el8_8.1	1
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	ncurses@6.3_p20220521-r0	6.3_p20220521-r1	1
registry.k8s.io/ingress-nginx/controller :v1.6.4	15be4666c530	ncurses@6.3_p20221119-r0	6.3_p20221119-r1	1
registry.k8s.io/ingress-nginx/controller :v1.3.1	54f7fe2c6c5a	ncurses@6.3_p20220521-r0	6.3_p20220521-r1	1
registry.k8s.io/ingress-nginx/controller :v1.7.0	7612338342a1	ncurses@6.3_p20221119-r0	6.3_p20221119-r1	1
registry.k8s.io/ingress-nginx/controller :v1.3.0	d1707ca76d3b	ncurses@6.3_p20220521-r0	6.3_p20220521-r1	1
registry.k8s.io/sig-storage/hostpathplugin :v1.9.0	92257881c1d6	ncurses@6.3_p20220521-r0	6.3_p20220521-r1	1