CVE-2023-45288

High

Advisory

Published 3 Apr 2024In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.920; 100th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,255; of 17,828 indexed, latest versions
Container images: 2,656; deployed by those charts
Fix available: 3 of 4; affected packages

Red Hat Security Advisory: git-lfs security update

Carried by container images the latest versions of 2,255 of 17,828 indexed charts deploy, on 2,656 images.

Affected package	Affected versions	Fixed in	Images
git-lfsrpm	2.13.3-3.el8_6	0:3.2.0-3.el8_9	1
golang-1.19deb	1.19.8-2	no fix listed	1
golang.org/x/netgolang	v0.0.0-20170114055629-f2499483f923, v0.0.0-20180301190904-22ae77b79946, v0.0.0-20180811021610-c39426892332, v0.0.0-20180906233101-161cd47e91fd+191 more	0.23.0	1,973
stdlibgolang	go1.13, go1.13.1, go1.13.3, go1.13.4+125 more	1.21.9	2,562

OSV records: DEBIAN-CVE-2023-45288 RHSA-2024:2699 GHSA-4v7x-pqxf-cx7m GO-2024-2687
Also known as: BIT-golang-2023-45288, RHSA-2024:4546

Charts affected

2,255 by stars

Chart

Latest

Affected images

Radar Score

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	golang.org/x/net@v0.8.0 stdlib@go1.20.4	0.23.0 1.21.9
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.23.0 1.21.9

Open the chart page →

5,077

zahori-moonzahori

1.0.1

3 of 3 See more

zahori-moon zahori 1.0.1

3 of the 3 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
quay.io/aerokube/moon :2.5.1	a8837b00ba1c	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.23.0 1.21.9
quay.io/aerokube/moon-conf :2.5.1	9ca307b30080	golang.org/x/net@v0.7.0 stdlib@go1.20.4	0.23.0 1.21.9
quay.io/aerokube/moon-ui :2.0.5	89990b146824	golang.org/x/net@v0.11.0 stdlib@go1.20.5	0.23.0 1.21.9

Open the chart page →

2,908

zahori-schedulerzahori

1.0.1

1 of 1 See more

zahori-scheduler zahori 1.0.1

1 of the 1 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
zahoriaut/zahori-scheduler :1.0.0	47d0979b1184	stdlib@go1.20.5	1.21.9

Open the chart page →

2,482

posthogzeet

0.23.2

1 of 9 See more

posthog zeet 0.23.2

1 of the 9 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
altinity/clickhouse-operator :0.19.0	7a85f522c5bc	golang.org/x/net@v0.0.0-20210525063256-abc453219eb5 stdlib@go1.17.13	0.23.0 1.21.9

Open the chart page →

3,702

zookeeper-exporterzookeeper-exporter

0.1.0

1 of 1 See more

zookeeper-exporter zookeeper-exporter 0.1.0

1 of the 1 container images this version deploys carry CVE-2023-45288.

Container image	Digest	Package	Fixed in
dabealu/zookeeper-exporter :latest	86106fec315f	stdlib@go1.14.15	1.21.9

Open the chart page →

1,249

Container images carrying it

2,656 by charts deploying them

A fixed version is listed for 3 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
jaegertracing/all-in-one :1.31	04d224a9999b	golang.org/x/net@v0.0.0-20220105145211-5b0dc2dfae98 stdlib@go1.17.6	0.23.0 1.21.9	2
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	golang.org/x/net@v0.7.0 stdlib@go1.20.6	0.23.0 1.21.9	2
jettech/kube-webhook-certgen :v1.2.1	c42098c8d855	golang.org/x/net@v0.0.0-20190108225652-1e06a53dbb7e stdlib@go1.13.11	0.23.0 1.21.9	2
jettech/kube-webhook-certgen :v1.5.0	fb7c2cd46ccf	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.3	0.23.0 1.21.9	2
jmalloc/echo-server :0.3.1	e4eaee2c7998	golang.org/x/net@v0.0.0-20210813160813-60bc85c4be6d stdlib@go1.17	0.23.0 1.21.9	2
k0sproject/k0s :v1.26.0-k0s.0	f04635825d51	golang.org/x/net@v0.5.0 stdlib@go1.19.4	0.23.0 1.21.9	2
kbudde/rabbitmq-exporter :1.0.0 :latest	12f27d6d84e6	stdlib@go1.21.8	1.21.9	2
kubernetesui/dashboard :v2.2.0	148991563e37	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.15.1	0.23.0 1.21.9	2
kubespheredev/kube-webhook-certgen :v1.1.1	23a03c9c381f	golang.org/x/net@v0.0.0-20210520170846-37e1c6afe023 stdlib@go1.16.9	0.23.0 1.21.9	2
lachlanevenson/k8s-kubectl :v1.25.4	af5cea3f2e40	golang.org/x/net@v0.0.0-20220722155237-a158d28d115b stdlib@go1.19.3	0.23.0 1.21.9	2
langgenius/dify-sandbox :0.2.0	09b7e8705673	golang.org/x/net@v0.20.0 stdlib@go1.20.6	0.23.0 1.21.9	2
library/arangodb :3.11.8	1e75d74954a4	stdlib@go1.21.5	1.21.9	2
library/cassandra :4.1.3	7cbcec0086ac	stdlib@go1.18.2	1.21.9	2
library/influxdb :2.6.1-alpine	44a366dd7724	golang.org/x/net@v0.0.0-20220617184016-355a448f1bc9 stdlib@go1.19.4	0.23.0 1.21.9	2
library/influxdb :2.7	b8d940ca9376	stdlib@go1.18.2	1.21.9	2
library/mariadb :10.8.3	0abf60f81588	stdlib@go1.16.7	1.21.9	2
library/mariadb :10.10	334b315c10e5	stdlib@go1.18.2	1.21.9	2
library/mariadb :11.3.2	e101f9db3191	stdlib@go1.18.2	1.21.9	2
library/mysql :8.2.0	212fe73edca5	stdlib@go1.18.2	1.21.9	2
library/mysql :8.4.2	ac80b6e09e5b	stdlib@go1.18.2	1.21.9	2
library/nats :2.9.17-alpine	1a7b320b2942	stdlib@go1.19.9	1.21.9	2
library/nats :2.10.7-alpine	1bcddab51b80	stdlib@go1.21.5	1.21.9	2
library/nats :2.10.5-alpine	85319e5e541b	stdlib@go1.21.4	1.21.9	2
library/nats :2.8.4-alpine	988010f74b61	stdlib@go1.17.10	1.21.9	2
library/postgres :16.1	09f23e02d766	stdlib@go1.18.2	1.21.9	2
library/postgres :16.2	4aea012537ed	stdlib@go1.18.2	1.21.9	2
library/postgres :9.6	caddd35b05cd	stdlib@go1.16.7	1.21.9	2
library/postgres :16.4	e62fbf9d3e2b	stdlib@go1.18.2	1.21.9	2
library/redis	148bb5411c18	stdlib@go1.18.2	1.21.9	2
library/redis :7.2.3	a7cee7c8178f	stdlib@go1.18.2	1.21.9	2
library/traefik :v2.5	7d5a6ae66572	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.23.0 1.21.9	2
library/traefik :2.4.8	eda951fd29a8	golang.org/x/net@v0.0.0-20210220033124-5f55cee0dc0d stdlib@go1.16.2	0.23.0 1.21.9	2
library/traefik :2.2.8	f5af5a5ce17f	golang.org/x/net@v0.0.0-20200301022130-244492dfa37a stdlib@go1.14.6	0.23.0 1.21.9	2
library/zookeeper :3.9.5	7d0f24ebb67b	stdlib@go1.18.1	1.21.9	2
linuxserver/cloud9 :latest :version-1.29.2	45c5fe102ff3	golang.org/x/net@v0.0.0-20201224014010-6772e930b67b stdlib@go1.17.11	0.23.0 1.21.9	2
listmonk/listmonk :v2.1.0	d2eac77ddfad	golang.org/x/net@v0.0.0-20211209124913-491a49abca63 stdlib@go1.17.6	0.23.0 1.21.9	2
longhornio/longhorn-manager :v1.2.3	dca34321452c	golang.org/x/net@v0.0.0-20201110031124-69a78807bb2b stdlib@go1.14.1	0.23.0 1.21.9	2
louislam/uptime-kuma :2.5.4	917318f9d7be	stdlib@go1.20.5	1.21.9	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	stdlib@go1.20.5	1.21.9	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	stdlib@go1.20.5	1.21.9	2
maxrocketinternet/soti-mobicontrol-exporter :0.6	1a281b76efa3	stdlib@go1.14	1.21.9	2
mesosphere/kubeaddons-catalog :v0.11.4	073db43d0b8b	golang.org/x/net@v0.0.0-20200707034311-ab3426394381 stdlib@go1.15.2	0.23.0 1.21.9	2
natsio/nats-box :0.11.0	9fbf7bf684e4	golang.org/x/net@v0.0.0-20211112202133-69e39bad7dc2 stdlib@go1.18.1	0.23.0 1.21.9	2
natsio/nats-server-config-reloader :0.7.2	911ce7ed2f55	stdlib@go1.19	1.21.9	2
natsio/nats-server-config-reloader :0.10.1	e414cc7e6f59	stdlib@go1.19.4	1.21.9	2
natsio/prometheus-nats-exporter :0.10.0	16048afb67a5	stdlib@go1.19	1.21.9	2
natsio/prometheus-nats-exporter :0.11.0	31c02aac089a	stdlib@go1.20.3	1.21.9	2
oliver006/redis_exporter :v1.9.0	4af75e9f16f6	stdlib@go1.14.4	1.21.9	2
openkruise/kruise-helm-hook :v0.1.0	edc7cf9428fd	stdlib@go1.20.14	1.21.9	2
openpolicyagent/gatekeeper :v3.4.0-rc.1	825370bdb3c3	golang.org/x/net@v0.0.0-20210119194325-5f4716e94777 stdlib@go1.16.2	0.23.0 1.21.9	2