CVE-2023-45288

High

Advisory

Published 3 Apr 2024In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.920; 100th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,156; of 17,790 indexed, latest versions
Container images: 2,573; deployed by those charts
Fix available: 3 of 4; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 2,156 of 17,790 indexed charts deploy, on 2,573 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.2.0-3.el8_9	1
golang-1.19deb	1.19.8-2	no fix listed	1
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+189 more	0.23.0	1,908
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+123 more	1.21.9	2,481

OSV records: DEBIAN-CVE-2023-45288 RHSA-2024:2699 GHSA-4v7x-pqxf-cx7m GO-2024-2687
Also known as: BIT-golang-2023-45288, RHSA-2024:4546

Charts affected

2,156 by stars

Chart

Latest

Affected images

Radar Score

version-checkerymrs

0.2.3

1 of 1 See more

version-checker ymrs 0.2.3

1 of the 1 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
quay.io/jetstack/version-checker :v0.2.1	5f6f8ba0b671	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.2	0.23.0 1.21.9

Open the chart page →

3,024

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.23.0 1.21.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.23.0 1.21.9

Open the chart page →

5,047

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.23.0 1.21.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.23.0 1.21.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	golang.org/x/net@v0.11.0 stdlib@go1.20.5	0.23.0 1.21.9

Open the chart page →

2,907

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.21.9

Open the chart page →

2,467

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.17.13	0.23.0 1.21.9

Open the chart page →

3,697

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.21.9

Open the chart page →

1,248

Container images carrying it

2,573 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
library/influxdb :2.7	b8d940ca9376	stdlib@go1.18.2	1.21.9	2
library/mariadb :10.8.3	0abf60f81588	stdlib@go1.16.7	1.21.9	2
library/mariadb :10.10	334b315c10e5	stdlib@go1.18.2	1.21.9	2
library/mariadb :11.3.2	e101f9db3191	stdlib@go1.18.2	1.21.9	2
library/mysql :8.2.0	212fe73edca5	stdlib@go1.18.2	1.21.9	2
library/mysql :8.4.2	ac80b6e09e5b	stdlib@go1.18.2	1.21.9	2
library/nats :2.9.17-alpine	1a7b320b2942	stdlib@go1.19.9	1.21.9	2
library/nats :2.10.7-alpine	1bcddab51b80	stdlib@go1.21.5	1.21.9	2
library/nats :2.10.5-alpine	85319e5e541b	stdlib@go1.21.4	1.21.9	2
library/nats :2.8.4-alpine	988010f74b61	stdlib@go1.17.10	1.21.9	2
library/postgres :16.1	09f23e02d766	stdlib@go1.18.2	1.21.9	2
library/postgres :16.2	4aea012537ed	stdlib@go1.18.2	1.21.9	2
library/postgres :9.6	caddd35b05cd	stdlib@go1.16.7	1.21.9	2
library/postgres :16.4	e62fbf9d3e2b	stdlib@go1.18.2	1.21.9	2
library/redis	148bb5411c18	stdlib@go1.18.2	1.21.9	2
library/redis :7.2.3	a7cee7c8178f	stdlib@go1.18.2	1.21.9	2
library/traefik :v2.5	7d5a6ae66572	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.23.0 1.21.9	2
library/zookeeper :3.9.5	f258365d4882	stdlib@go1.18.1	1.21.9	2
listmonk/listmonk :v2.1.0	d2eac77ddfad	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.23.0 1.21.9	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	stdlib@go1.20.5	1.21.9	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	stdlib@go1.20.5	1.21.9	2
maxrocketinternet/soti-mobicontrol-exporter :0.6	1a281b76efa3	stdlib@go1.14	1.21.9	2
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.2	0.23.0 1.21.9	2
minio/mc :RELEASE.2020-11-25T23-04-07Z	bf85c57cdfcc	golang.org/x/net@v0.0.0-20201021035429-f5854403a974 stdlib@go1.15.5	0.23.0 1.21.9	2
minio/operator :v4.3.7	54393e03f3b2	golang.org/x/net@v0.0.0-20210421230115-4e50805a0758 stdlib@go1.17.4	0.23.0 1.21.9	2
natsio/nats-account-server :1.0.0	a3381560aab6	stdlib@go1.16.6	1.21.9	2
natsio/nats-box :0.11.0	9fbf7bf684e4	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.18.1	0.23.0 1.21.9	2
natsio/nats-server-config-reloader :0.7.2	911ce7ed2f55	stdlib@go1.19	1.21.9	2
natsio/nats-server-config-reloader :0.10.1	e414cc7e6f59	stdlib@go1.19.4	1.21.9	2
natsio/prometheus-nats-exporter :0.10.0	16048afb67a5	stdlib@go1.19	1.21.9	2
natsio/prometheus-nats-exporter :0.11.0	31c02aac089a	stdlib@go1.20.3	1.21.9	2
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.21.9	2
openebs/node-disk-manager :2.1.0	f6c18b0f8c8a	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19.3	0.23.0 1.21.9	2
openebs/node-disk-operator :2.1.0	6afe2123c457	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19.3	0.23.0 1.21.9	2
openebs/provisioner-localpv :3.5.0	aea39e49bb97	golang.org/x/net@v0.17.0 stdlib@go1.19.13	0.23.0 1.21.9	2
openkruise/kruise-helm-hook :v0.1.0	edc7cf9428fd	stdlib@go1.20.14	1.21.9	2
openpolicyagent/gatekeeper :v3.4.0-rc.1	825370bdb3c3	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.16.2	0.23.0 1.21.9	2
oryd/kratos :v1.0.0	d06fc5845f63	golang.org/x/net@v0.8.0 stdlib@go1.20.5	0.23.0 1.21.9	2
oryd/oathkeeper :v0.40.6	e8cb9b79a89c	golang.org/x/net@v0.9.0 stdlib@go1.20.5	0.23.0 1.21.9	2
osixia/openldap :1.4.0	ccd95cc6e61e	golang.org/x/net@v0.0.0-20190404232315-eb5bcb51f2a3 stdlib@go1.13.4	0.23.0 1.21.9	2
otel/opentelemetry-collector-contrib :0.96.0	7ef2a2ff46b9	golang.org/x/net@v0.21.0 stdlib@go1.21.7	0.23.0 1.21.9	2
outlinewiki/outline :0.69.1	d060dcd8f9aa	stdlib@go1.19.4	1.21.9	2
passbolt/passbolt :3.4.0-ce-non-root	655547e17263	stdlib@go1.14.4	1.21.9	2
phntom/kochi :1.1.3	3b82358bd56e	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.15.5	0.23.0 1.21.9	2
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.13.8	0.23.0 1.21.9	2
postgis/postgis :15-3.3	a2fc46b52819	stdlib@go1.18.2	1.21.9	2
pottava/s3-proxy :2.0	20a0bcb15f76	stdlib@go1.13.7	1.21.9	2
prom/blackbox-exporter :v0.18.0	1ffc3f109eb3	golang.org/x/net@v0.0.0-20200602114024-627f9648deb9 stdlib@go1.15.2	0.23.0 1.21.9	2
prom/prometheus :v2.17.2	42d2395cd719	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a stdlib@go1.13.10	0.23.0 1.21.9	2
prom/prometheus :v2.37.9	8176adea328e	golang.org/x/net@v0.7.0 stdlib@go1.19.11	0.23.0 1.21.9	2