CVE-2020-8559
Fixed in a distro release EPSS 6%CVSS 6.4
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/apimachinery | 0.16.13 |
| Go | k8s.io/apimachinery | 0.17.9 |
| Go | k8s.io/apimachinery | 0.18.7 |
| Go | k8s.io/apimachinery | 0.18.7-rc.0 |
| Go | k8s.io/kubernetes | 1.16.13 |
| Go | k8s.io/kubernetes | 1.17.9 |
| Go | k8s.io/kubernetes | 1.18.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | actions-runner-controller-fips | 0.10.1-r6 |
| Chainguard | actions-runner-controller-fips-compat | 0.10.1-r6 |
| Chainguard | addon-resizer-fips | 1.8.23-r3 |
| Chainguard | addon-resizer-fips-compat | 1.8.23-r3 |
| Chainguard | argo-workflow-cli-fips | 3.6.5-r2 |
| Chainguard | argo-workflow-controller-compat-fips | 3.6.5-r2 |
| Chainguard | argo-workflow-controller-fips | 3.6.5-r2 |
| Chainguard | argo-workflow-executor-compat-fips | 3.6.5-r2 |
| Chainguard | argo-workflow-executor-fips | 3.6.5-r2 |
| Chainguard | argo-workflows-fips | 3.6.5-r2 |
| Chainguard | argo-workflows-known-hosts-fips | 3.6.5-r2 |
| Chainguard | aws-ebs-csi-driver-fips | 1.41.0-r0 |
| Chainguard | aws-efs-csi-driver-fips | 2.1.7-r0 |
| Chainguard | aws-load-balancer-controller-fips | 2.12.0-r1 |
| Chainguard | azure-aad-pod-identity-mic | 1.8.17-r20 |
| Chainguard | azure-aad-pod-identity-nmi | 1.8.17-r20 |
| Chainguard | bank-vaults-fips | 1.20.4-r24 |
| Chainguard | bank-vaults-template-fips | 1.20.4-r24 |
| Chainguard | cass-operator-compat-fips | 1.23.2-r0 |
| Chainguard | cass-operator-fips | 1.23.2-r0 |
| Chainguard | cass-operator-fips-no-pvc-delete | 1.23.2-r0 |
| Chainguard | cass-operator-fips-no-pvc-delete-compat | 1.23.2-r0 |
| Chainguard | cert-exporter | 2.14.0-r9 |
| Chainguard | cert-exporter-fips | 2.14.0-r9 |
| Chainguard | cert-manager-1.12 | 1.12.16-r6 |
| Chainguard | cert-manager-1.12-acmesolver | 1.12.16-r6 |
| Chainguard | cert-manager-1.12-cainjector | 1.12.16-r6 |
| Chainguard | cert-manager-1.12-controller | 1.12.16-r6 |
| Chainguard | cert-manager-1.12-webhook | 1.12.16-r6 |
| Chainguard | cert-manager-acmesolver-1.12 | 1.12.16-r6 |
| Chainguard | cert-manager-acmesolver-1.12-bitnami-compat | 1.12.16-r6 |
| Chainguard | cert-manager-acmesolver-1.12-iamguarded-compat | 1.12.16-r6 |
| Chainguard | cert-manager-acmesolver-fips-1.12 | 1.12.16-r5 |
| Chainguard | cert-manager-cainjector-1.12 | 1.12.16-r6 |
| Chainguard | cert-manager-cainjector-1.12-bitnami-compat | 1.12.16-r6 |
| Chainguard | cert-manager-cainjector-1.12-iamguarded-compat | 1.12.16-r6 |
| Chainguard | cert-manager-cainjector-fips-1.12 | 1.12.16-r5 |
| Chainguard | cert-manager-controller-1.12 | 1.12.16-r6 |
| Chainguard | cert-manager-controller-1.12-bitnami-compat | 1.12.16-r6 |
| Chainguard | cert-manager-controller-1.12-iamguarded-compat | 1.12.16-r6 |
| Chainguard | cert-manager-controller-fips-1.12 | 1.12.16-r5 |
| Chainguard | cert-manager-fips-1.12 | 1.12.16-r5 |
| Chainguard | cert-manager-fips-1.12-acmesolver | 1.12.16-r5 |
| Chainguard | cert-manager-fips-1.12-cainjector | 1.12.16-r5 |
| Chainguard | cert-manager-fips-1.12-cmctl | 1.12.16-r5 |
| Chainguard | cert-manager-fips-1.12-controller | 1.12.16-r5 |
| Chainguard | cert-manager-fips-1.12-webhook | 1.12.16-r5 |
| Chainguard | cert-manager-webhook-1.12 | 1.12.16-r6 |
| Chainguard | cert-manager-webhook-1.12-bitnami-compat | 1.12.16-r6 |
| Chainguard | cert-manager-webhook-1.12-iamguarded-compat | 1.12.16-r6 |
| Chainguard | cert-manager-webhook-fips-1.12 | 1.12.16-r5 |
| Chainguard | cert-manager-webhook-pdns-fips | 2.5.2-r3 |
| Chainguard | cilium-1.14 | 1.14.19-r23 |
| Chainguard | cilium-1.14-clustermesh-apiserver | 1.14.19-r23 |
| Chainguard | cilium-1.14-container-init | 1.14.19-r23 |
| Chainguard | cilium-1.14-container-init-compat | 1.14.19-r23 |
| Chainguard | cilium-1.14-hubble-relay | 1.14.19-r23 |
| Chainguard | cilium-1.14-iptables | 1.14.19-r23 |
| Chainguard | cilium-1.14-operator-aws | 1.14.19-r23 |
| Chainguard | cilium-1.14-operator-generic | 1.14.19-r23 |
| Chainguard | cilium-cli | 0.18.2-r2 |
| Chainguard | cilium-fips-1.14 | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-clustermesh-apiserver | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-compat | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-container-init | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-container-init-compat | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-host-utils | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-hubble-relay | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-iptables | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-aws | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-azure | 1.14.19-r24 |
| Chainguard | cilium-fips-1.14-operator-generic | 1.14.19-r24 |
| Chainguard | cluster-autoscaler-1.28 | 1.28.7-r7 |
| Chainguard | cluster-autoscaler-1.28-compat | 1.28.7-r7 |
| Chainguard | cluster-autoscaler-fips-1.28 | 1.28.7-r7 |
| Chainguard | cluster-autoscaler-fips-1.28-compat | 1.28.7-r7 |
| Chainguard | cluster-autoscaler-fips-1.29 | 1.29.5-r8 |
| Chainguard | cluster-autoscaler-fips-1.29-compat | 1.29.5-r8 |
| Chainguard | cmctl-1.12 | 1.12.16-r6 |
| Chainguard | cmctl-1.12-fips | 1.12.16-r5 |
| Chainguard | cmctl-fips-1.12 | 1.12.16-r5 |
| Chainguard | consul-1.17 | 1.17.4-r34 |
| Chainguard | consul-1.17-oci-entrypoint | 1.17.4-r34 |
| Chainguard | consul-1.17-oci-entrypoint-compat | 1.17.4-r34 |
| Chainguard | coredns-fips | 1.12.0-r9 |
| Chainguard | cosign-fips | 2.4.3-r5 |
| Chainguard | datadog-agent-core-integrations-fips | 7.64.1-r0 |
| Chainguard | datadog-agent-fakeintake-fips | 7.64.1-r0 |
| Chainguard | datadog-agent-fips | 7.64.1-r0 |
| Chainguard | datadog-agent-jmx-fips | 7.64.1-r0 |
| Chainguard | datadog-agent-oci-compat-fips | 7.64.1-r0 |
| Chainguard | datadog-agent-s6-overlay-fips | 7.64.1-r0 |
| Chainguard | datadog-cluster-agent | 7.64.1-r0 |
| Chainguard | datadog-cluster-agent-fips | 7.64.1-r0 |
| Chainguard | datadog-cluster-agent-oci-compat | 7.64.1-r0 |
| Chainguard | datadog-cluster-agent-oci-compat-fips | 7.64.1-r0 |
| Chainguard | dynamic-localpv-provisioner-fips | 4.2.0-r4 |
| Chainguard | eksctl | 0.205.0-r4 |
| Chainguard | external-dns-fips | 0.16.1-r0 |
| Chainguard | external-dns-fips-bitnami-compat | 0.16.1-r0 |
| Chainguard | external-dns-fips-iamguarded-compat | 0.16.1-r0 |
| Chainguard | external-secrets-fips | 0.15.0-r0 |
| Chainguard | falcoctl | 0.7.3-r8 |
| Chainguard | falcoctl-fips | 0.11.0-r6 |
| Chainguard | falcoctl-fips-0.4 | 0.4.0-r18 |
| Chainguard | falcosidekick-fips | 2.31.1-r5 |
| Chainguard | fulcio-fips | 1.6.6-r6 |
| Chainguard | ghaudit | 0.4.0-r1 |
| Chainguard | glab | 1.54.0-r0 |
| Chainguard | gpu-operator | 24.9.2-r4 |
| Chainguard | grafana-fips-10.4 | 10.4.16-r3 |
| Chainguard | grafana-fips-10.4-oci-compat | 10.4.16-r3 |
| Chainguard | grafana-operator-fips | 5.17.0-r1 |
| Chainguard | grafana-operator-fips-bitnami-compat | 5.17.0-r1 |
| Chainguard | harbor-2.9 | 2.9.5-r13 |
| Chainguard | harbor-2.9-db | 2.9.5-r13 |
| Chainguard | harbor-2.9-jobservice | 2.9.5-r13 |
| Chainguard | harbor-2.9-portal | 2.9.5-r13 |
| Chainguard | harbor-2.9-portal-nginx-config | 2.9.5-r13 |
| Chainguard | harbor-2.9-registryctl | 2.9.5-r13 |
| Chainguard | harbor-fips-2.10 | 2.10.3-r12 |
| Chainguard | harbor-fips-2.10-db | 2.10.3-r12 |
| Chainguard | harbor-fips-2.10-exporter | 2.10.3-r12 |
| Chainguard | harbor-fips-2.10-jobservice | 2.10.3-r12 |
| Chainguard | harbor-fips-2.10-portal | 2.10.3-r12 |
| Chainguard | harbor-fips-2.10-redis-compat | 2.10.3-r12 |
| Chainguard | harbor-fips-2.10-registryctl | 2.10.3-r12 |
| Chainguard | harbor-fips-2.9 | 2.9.5-r12 |
| Chainguard | harbor-fips-2.9-db | 2.9.5-r12 |
| Chainguard | harbor-fips-2.9-jobservice | 2.9.5-r12 |
| Chainguard | harbor-fips-2.9-portal | 2.9.5-r12 |
| Chainguard | harbor-fips-2.9-registryctl | 2.9.5-r12 |
| Chainguard | helm-fips | 3.17.2-r1 |
| Chainguard | helm-fips-3 | 3.19.2-r0 |
| Chainguard | helm-fips-4 | 4.0.1-r1 |
| Chainguard | helm-operator | 1.39.2-r0 |
| Chainguard | helm-operator-compat | 1.39.2-r0 |
| Chainguard | helm-operator-fips | 1.39.2-r0 |
| Chainguard | helm-operator-fips-compat | 1.39.2-r0 |
| Chainguard | hubble | 1.17.1-r2 |
| Chainguard | hubble-compat | 1.17.1-r2 |
| Chainguard | hubble-fips | 1.17.1-r2 |
| Chainguard | hubble-fips-compat | 1.17.1-r2 |
| Chainguard | hubble-ui-backend-fips | 0.13.2-r2 |
| Chainguard | istio-cni-fips-1.21 | 1.21.6-r10 |
| Chainguard | istio-cni-fips-1.21-compat | 1.21.6-r10 |
| Chainguard | istio-fips-1.21 | 1.21.6-r10 |
| Chainguard | istio-install-cni-fips-1.21 | 1.21.6-r10 |
| Chainguard | istio-install-cni-fips-1.21-compat | 1.21.6-r10 |
| Chainguard | istio-operator-fips-1.21 | 1.21.6-r10 |
| Chainguard | istio-pilot-agent-fips-1.21 | 1.21.6-r10 |
| Chainguard | istio-pilot-agent-fips-1.21-compat | 1.21.6-r10 |
| Chainguard | istio-pilot-discovery-fips-1.21 | 1.21.6-r10 |
| Chainguard | k8ssandra-operator-fips | 1.21.1-r2 |
| Chainguard | k8ssandra-operator-fips-compat | 1.21.1-r2 |
| Chainguard | karpenter-0.23 | 0.23.0-r24 |
| Chainguard | karpenter-0.35 | 0.35.12-r3 |
| Chainguard | karpenter-fips-0.35 | 0.35.12-r3 |
| Chainguard | karpenter-fips-0.36 | 0.36.9-r3 |
| Chainguard | keda-adapter-fips | 2.16.1-r8 |
| Chainguard | keda-admission-webhooks-fips | 2.16.1-r8 |
| Chainguard | keda-fips | 2.16.1-r8 |
| Chainguard | keda-metrics-apiserver-fips | 2.16.1-r8 |
| Chainguard | kiam | 4.2-r22 |
| Chainguard | kiam-compat | 4.2-r22 |
| Chainguard | kine | 0.13.11-r0 |
| Chainguard | ko-fips | 0.17.1-r10 |
| Chainguard | kots | 1.124.8-r0 |
| Chainguard | kots-compat | 1.124.8-r0 |
| Chainguard | kots-symlink-compat | 1.124.8-r0 |
| Chainguard | kube-bench-configs-fips | 0.10.4-r2 |
| Chainguard | kube-bench-fips | 0.10.4-r2 |
| Chainguard | kube-logging-logging-operator-3.17 | 3.17.11-r21 |
| Chainguard | kube-logging-logging-operator-3.17-compat | 3.17.11-r21 |
| Chainguard | kube-logging-logging-operator-4.1 | 4.1.0-r17 |
| Chainguard | kube-logging-logging-operator-4.1-compat | 4.1.0-r17 |
| Chainguard | kube-oidc-proxy | 1.0.9-r7 |
| Chainguard | kube-rbac-proxy-fips | 0.19.0-r3 |
| Chainguard | kube-state-metrics-2.6 | 2.6.0-r24 |
| Chainguard | kube-state-metrics-fips | 2.15.0-r6 |
| Chainguard | kube-state-metrics-fips-iamguarded-compat | 2.15.0-r6 |
| Chainguard | kubeadm-bootstrap-controller | 1.9.6-r0 |
| Chainguard | kubeflow-access-management | no fix |
| Chainguard | kubeflow-access-management-fips | no fix |
| Chainguard | kubeflow-pipelines-apiserver | 2.14.3-r3 |
| Chainguard | kubernetes-csi-livenessprobe-2.10 | 2.10.0-r17 |
| Chainguard | kubernetes-csi-livenessprobe-fips | 2.15.0-r4 |
| Chainguard | kubernetes-csi-livenessprobe-fips-2.10 | 2.10.0-r19 |
| Chainguard | kubernetes-csi-node-driver-registrar-2.6 | 2.6.3-r12 |
| Chainguard | kubernetes-csi-node-driver-registrar-2.6-compat | 2.6.3-r12 |
| Chainguard | kubernetes-csi-node-driver-registrar-2.7 | 2.7.0-r12 |
| Chainguard | kubernetes-csi-node-driver-registrar-2.7-compat | 2.7.0-r12 |
| Chainguard | kubernetes-csi-node-driver-registrar-2.8 | 2.8.0-r12 |
| Chainguard | kubernetes-csi-node-driver-registrar-2.8-compat | 2.8.0-r12 |
| Chainguard | kubernetes-csi-node-driver-registrar-2.9 | 2.9.4-r12 |
| Chainguard | kubernetes-csi-node-driver-registrar-2.9-compat | 2.9.4-r12 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.10 | 2.10.1-r11 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.10-compat | 2.10.1-r11 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.6 | 2.6.3-r11 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.6-compat | 2.6.3-r11 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.7 | 2.7.0-r11 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.7-compat | 2.7.0-r11 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.8 | 2.8.0-r22 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.8-compat | 2.8.0-r22 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.9 | 2.9.4-r11 |
| Chainguard | kubernetes-csi-node-driver-registrar-fips-2.9-compat | 2.9.4-r11 |
| Chainguard | kubernetes-dashboard | 7.11.1-r1 |
| Chainguard | kubernetes-dashboard-fips | 7.11.1-r1 |
| Chainguard | kubernetes-dashboard-metrics-scraper | 1.2.2-r5 |
| Chainguard | kubernetes-dashboard-metrics-scraper-compat | 1.2.2-r5 |
| Chainguard | kubernetes-dashboard-metrics-scraper-fips | 1.2.2-r4 |
| Chainguard | kubernetes-dns-node-cache | 1.25.0-r5 |
| Chainguard | kubernetes-secret-generator | 3.4.1-r1 |
| Chainguard | kubernetes-secret-generator-compat | 3.4.1-r1 |
| Chainguard | kubevela | 1.10.2-r4 |
| Chainguard | kubevela-vela-cli | 1.10.2-r4 |
| Chainguard | kubevela-vela-core | 1.10.2-r4 |
| Chainguard | kubevela-vela-core-compat | 1.10.2-r4 |
| Chainguard | kubewatch | 2.9.0-r7 |
| Chainguard | kwok | 0.6.1-r7 |
| Chainguard | kwokctl | 0.6.1-r7 |
| Chainguard | kyverno-policy-reporter | 3.0.7-r1 |
| Chainguard | kyverno-policy-reporter-compat | 3.0.7-r1 |
| Chainguard | local-path-provisioner | 0.0.31-r3 |
| Chainguard | local-static-provisioner | 2.7.0-r15 |
| Chainguard | local-static-provisioner-compat | 2.7.0-r15 |
| Chainguard | local-volume-node-cleanup | 2.7.0-r15 |
| Chainguard | local-volume-node-cleanup-compat | 2.7.0-r15 |
| Chainguard | melange | 0.23.0-r1 |
| Chainguard | melange-microvm-init | 0.23.0-r1 |
| Chainguard | metallb-controller-compat-fips | 0.14.9-r5 |
| Chainguard | metallb-controller-fips | 0.14.9-r5 |
| Chainguard | metallb-cp-tool-compat-fips | 0.14.9-r5 |
| Chainguard | metallb-cp-tool-fips | 0.14.9-r5 |
| Chainguard | metallb-fips | 0.14.9-r5 |
| Chainguard | metallb-frr-compat-fips | 0.14.9-r5 |
| Chainguard | metallb-frr-fips | 0.14.9-r5 |
| Chainguard | metallb-speaker-compat-fips | 0.14.9-r5 |
| Chainguard | metallb-speaker-fips | 0.14.9-r5 |
| Chainguard | metrics-server-fips | 0.7.2-r11 |
| Chainguard | metrics-server-fips-bitnami-compat | 0.7.2-r11 |
| Chainguard | multus-cni-fips | 4.1.4-r6 |
| Chainguard | multus-cni-fips-compat | 4.1.4-r6 |
| Chainguard | newrelic-infra-operator | 0.21.6-r3 |
| Chainguard | newrelic-nri-kube-events | 2.11.8-r1 |
| Chainguard | newrelic-nri-kube-events-1.9 | 1.9.3-r14 |
| Chainguard | newrelic-nri-statsd | 2.11.0-r0 |
| Chainguard | nfs-subdir-external-provisioner-fips | 4.0.18-r20 |
| Chainguard | nodetaint | 0.0.4-r30 |
| Chainguard | nri-discovery-kubernetes | 1.11.0-r0 |
| Chainguard | nri-discovery-kubernetes-compat | 1.11.0-r0 |
| Chainguard | nri-kubernetes | 3.35.0-r0 |
| Chainguard | nri-kubernetes-2.13 | 2.13.15-r14 |
| Chainguard | nri-kubernetes-2.13-compat | 2.13.15-r14 |
| Chainguard | opentelemetry-collector-contrib | 0.122.0-r1 |
| Chainguard | opentelemetry-collector-contrib-compat | 0.122.0-r1 |
| Chainguard | opentelemetry-collector-contrib-fips | 0.121.0-r2 |
| Chainguard | policy-controller-fips | 0.12.0-r7 |
| Chainguard | policy-controller-tester-fips | 0.12.0-r7 |
| Chainguard | postgres-operator | 1.14.0-r5 |
| Chainguard | postgres-operator-compat | 1.14.0-r5 |
| Chainguard | postgres-operator-fips | 1.14.0-r5 |
| Chainguard | postgres-operator-fips-compat | 1.14.0-r5 |
| Chainguard | prometheus-2.51 | 2.51.2-r48 |
| Chainguard | prometheus-adapter | 0.12.0-r10 |
| Chainguard | prometheus-adapter-0.10 | 0.10.1-r19 |
| Chainguard | prometheus-adapter-fips | 0.12.0-r11 |
| Chainguard | prometheus-adapter-fips-0.10 | 0.10.1-r19 |
| Chainguard | prometheus-admission-webhook-fips | 0.81.0-r1 |
| Chainguard | prometheus-config-reloader-fips | 0.81.0-r1 |
| Chainguard | prometheus-config-reloader-oci-entrypoint-compat-fips | 0.81.0-r1 |
| Chainguard | prometheus-operator-fips | 0.81.0-r1 |
| Chainguard | prometheus-operator-fips-iamguarded-compat | 0.81.0-r1 |
| Chainguard | pulumi-kubernetes-operator | 1.16.0-r13 |
| Chainguard | rabbitmq-cluster-operator | 2.12.1-r3 |
| Chainguard | rabbitmq-cluster-operator-bitnami-compat | 2.12.1-r3 |
| Chainguard | rabbitmq-cluster-operator-compat | 2.12.1-r3 |
| Chainguard | rabbitmq-cluster-operator-iamguarded-compat | 2.12.1-r3 |
| Chainguard | rabbitmq-messaging-topology-operator | 1.16.0-r4 |
| Chainguard | rabbitmq-messaging-topology-operator-bitnami-compat | 1.16.0-r4 |
| Chainguard | rabbitmq-messaging-topology-operator-compat | 1.16.0-r4 |
| Chainguard | rabbitmq-messaging-topology-operator-iamguarded-compat | 1.16.0-r4 |
| Chainguard | request-1279 | 1.21.1-r2 |
| Chainguard | request-1279-compat | 1.21.1-r2 |
| Chainguard | secrets-store-csi-driver-provider-aws | 0.3.11-r32 |
| Chainguard | secrets-store-csi-driver-provider-aws-compat | 0.3.11-r32 |
| Chainguard | secrets-store-csi-driver-provider-azure | 1.6.2-r32 |
| Chainguard | secrets-store-csi-driver-provider-azure-compat | 1.6.2-r32 |
| Chainguard | sigstore-scaffolding-fips | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-cloudsqlproxy | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-ctlog-createctconfig | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-ctlog-managectroots | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-ctlog-verifyfulcio | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-fulcio-createcerts | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-getoidctoken | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-rekor-createsecret | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-trillian-createdb | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-trillian-createtree | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-trillian-updatetree | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-tsa-createcertchain | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-tuf-createsecret | 0.7.21-r2 |
| Chainguard | sigstore-scaffolding-fips-tuf-server | 0.7.21-r2 |
| Chainguard | skaffold | 2.14.2-r0 |
| Chainguard | slsa-verifier | 2.7.0-r3 |
| Chainguard | sonobuoy | 0.57.3-r2 |
| Chainguard | sonobuoy-compat | 0.57.3-r2 |
| Chainguard | spark-operator | 2.1.0-r8 |
| Chainguard | spark-operator-oci-entrypoint | 2.1.0-r8 |
| Chainguard | sparkctl | 2.1.0-r8 |
| Chainguard | spire-agent | 1.11.2-r5 |
| Chainguard | spire-agent-fips | 1.12.0-r0 |
| Chainguard | spire-oidc-discovery-provider | 1.11.2-r5 |
| Chainguard | spire-oidc-discovery-provider-fips | 1.12.0-r0 |
| Chainguard | spire-server | 1.11.2-r5 |
| Chainguard | spire-server-fips | 1.12.0-r0 |
| Chainguard | src | 6.1.0-r3 |
| Chainguard | stakater-reloader | 1.3.0-r2 |
| Chainguard | stakater-reloader-0.0.119 | 0.0.119-r18 |
| Chainguard | stakater-reloader-0.0.128 | 0.0.128-r17 |
| Chainguard | stakater-reloader-compat | 1.3.0-r2 |
| Chainguard | stakater-reloader-compat-0.0.119 | 0.0.119-r18 |
| Chainguard | stakater-reloader-compat-0.0.128 | 0.0.128-r17 |
| Chainguard | step-issuer | 0.9.8-r0 |
| Chainguard | step-issuer-compat | 0.9.8-r0 |
| Chainguard | step-issuer-fips | 0.9.8-r0 |
| Chainguard | step-issuer-fips-compat | 0.9.8-r0 |
| Chainguard | stern | 1.32.0-r3 |
| Chainguard | tekton-chains | 0.24.0-r5 |
| Chainguard | tekton-chains-fips | 0.24.0-r5 |
| Chainguard | tekton-pipelines | 0.69.0-r2 |
| Chainguard | tekton-pipelines-controller-fips | 0.69.1-r0 |
| Chainguard | tekton-pipelines-entrypoint | 0.69.0-r2 |
| Chainguard | tekton-pipelines-entrypoint-fips | 0.69.1-r0 |
| Chainguard | tekton-pipelines-events | 0.69.0-r2 |
| Chainguard | tekton-pipelines-events-fips | 0.69.1-r0 |
| Chainguard | tekton-pipelines-fips | 0.69.1-r0 |
| Chainguard | tekton-pipelines-nop | 0.69.0-r2 |
| Chainguard | tekton-pipelines-nop-fips | 0.69.1-r0 |
| Chainguard | tekton-pipelines-resolvers | 0.69.0-r2 |
| Chainguard | tekton-pipelines-resolvers-fips | 0.69.1-r0 |
| Chainguard | tekton-pipelines-sidecarlogresults | 0.69.0-r2 |
| Chainguard | tekton-pipelines-sidecarlogresults-fips | 0.69.1-r0 |
| Chainguard | tekton-pipelines-webhook | 0.69.0-r2 |
| Chainguard | tekton-pipelines-webhook-fips | 0.69.1-r0 |
| Chainguard | tekton-pipelines-workingdirinit | 0.69.0-r2 |
| Chainguard | tekton-pipelines-workingdirinit-fips | 0.69.1-r0 |
| Chainguard | terraform | 1.5.7-r25 |
| Chainguard | terraform-compat | 1.5.7-r25 |
| Chainguard | terraform-local-provider-config | 1.5.7-r25 |
| Chainguard | thanos-fips | 0.37.2-r7 |
| Chainguard | thanos-fips-iamguarded-compat | 0.37.2-r7 |
| Chainguard | thanos-operator-compat | 0.3.7-r26 |
| Chainguard | thanos-operator-fips | 0.3.7-r26 |
| Chainguard | thanos-operator-fips-compat | 0.3.7-r26 |
| Chainguard | tigera-operator-1.28 | 1.28.15-r19 |
| Chainguard | tigera-operator-1.29 | 1.29.8-r19 |
| Chainguard | tigera-operator-1.30 | 1.30.11-r10 |
| Chainguard | tigera-operator-1.31 | 1.31.2-r23 |
| Chainguard | tigera-operator-1.32 | 1.32.13-r7 |
| Chainguard | tigera-operator-fips-1.29 | 1.29.8-r19 |
| Chainguard | tkn | 0.40.0-r4 |
| Chainguard | tkn-fips | 0.40.0-r4 |
| Chainguard | trust-manager | 0.16.0-r2 |
| Chainguard | trust-manager-fips | 0.16.0-r3 |
| Chainguard | up | no fix |
| Chainguard | vault-csi-provider | 1.6.0-r2 |
| Chainguard | vault-k8s | 1.6.2-r1 |
| Chainguard | vault-k8s-fips | 1.4.2-r8 |
| Chainguard | vela-cli | 1.10.2-r4 |
| Chainguard | vela-core | 1.10.2-r4 |
| Chainguard | velero-compat-fips | 1.15.2-r5 |
| Chainguard | velero-fips | 1.15.2-r5 |
| Chainguard | velero-plugin-for-aws-fips | 1.11.1-r32 |
| Chainguard | velero-plugin-for-aws-fips-compat | 1.11.1-r32 |
| Chainguard | velero-plugin-for-csi | 0.7.1-r32 |
| Chainguard | velero-plugin-for-csi-compat | 0.7.1-r32 |
| Chainguard | velero-plugin-for-csi-fips | 0.7.1-r32 |
| Chainguard | velero-plugin-for-csi-fips-compat | 0.7.1-r32 |
| Chainguard | velero-restore-helper-fips | 1.15.2-r5 |
| Chainguard | vertical-pod-autoscaler-fips | 1.3.0-r3 |
| Chainguard | vertical-pod-autoscaler-recommender-fips | 1.3.0-r3 |
| Chainguard | vertical-pod-autoscaler-updater-fips | 1.3.0-r3 |
| Chainguard | volume-modifier-for-k8s | 0.5.1-r4 |
| Chainguard | volume-modifier-for-k8s-fips | 0.5.1-r4 |
| Chainguard | wavefront-collector-for-kubernetes-1.12 | 1.12.1-r23 |
| Chainguard | wavefront-collector-for-kubernetes-1.13 | 1.13.0-r23 |
| Chainguard | zarf | 0.50.0-r0 |
| Chainguard | zot | 2.1.2-r7 |
| Debian:12 | kubernetes | 1.18.5-1 |
| Debian:13 | kubernetes | 1.18.5-1 |
| Debian:14 | kubernetes | 1.18.5-1 |
| Red Hat:openshift:3.11 | atomic-openshift | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-clients-redistributable | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-docker-excluder | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-excluder | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hyperkube | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-hypershift | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-master | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-node | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-pod | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-sdn-ovs | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-template-service-broker | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:3.11 | atomic-openshift-tests | 0:3.11.346-1.git.0.ea10721.el7 |
| Red Hat:openshift:4.4 | openshift | 0:4.4.0-202012052258.p0.git.0.0fd57a4.el7 |
| Red Hat:openshift:4.4 | openshift | 0:4.4.0-202012052258.p0.git.0.0fd57a4.el8 |
| Red Hat:openshift:4.4 | openshift-hyperkube | 0:4.4.0-202012052258.p0.git.0.0fd57a4.el8 |
| Red Hat:openshift:4.4 | openshift-hyperkube | 0:4.4.0-202012052258.p0.git.0.0fd57a4.el7 |
| Red Hat:openshift:4.6 | ignition | 0:2.6.0-5.rhaos4.6.git947598e.el8 |
| Red Hat:openshift:4.6 | ignition-debuginfo | 0:2.6.0-5.rhaos4.6.git947598e.el8 |
| Red Hat:openshift:4.6 | ignition-debugsource | 0:2.6.0-5.rhaos4.6.git947598e.el8 |
| Red Hat:openshift:4.6 | ignition-validate | 0:2.6.0-5.rhaos4.6.git947598e.el8 |
| Red Hat:openshift:4.6 | ignition-validate-debuginfo | 0:2.6.0-5.rhaos4.6.git947598e.el8 |
| Red Hat:openshift:4.6 | openshift | 0:4.6.0-202010022112.p0.git.94033.ef41184.el7 |
| Red Hat:openshift:4.6 | openshift | 0:4.6.0-202010022112.p0.git.94033.ef41184.el8 |
| Red Hat:openshift:4.6 | openshift-hyperkube | 0:4.6.0-202010022112.p0.git.94033.ef41184.el8 |
| Red Hat:openshift:4.6 | openshift-hyperkube | 0:4.6.0-202010022112.p0.git.94033.ef41184.el7 |
| Ubuntu:22.04:LTS | kubernetes | no fix |
| Ubuntu:24.04:LTS | kubernetes | no fix |
| Ubuntu:Pro:20.04:LTS | kubernetes | no fix |
| Wolfi | cert-exporter | 2.14.0-r9 |
| Wolfi | cert-manager-1.12 | 1.12.16-r6 |
| Wolfi | cert-manager-1.12-acmesolver | 1.12.16-r6 |
| Wolfi | cert-manager-1.12-cainjector | 1.12.16-r6 |
| Wolfi | cert-manager-1.12-controller | 1.12.16-r6 |
| Wolfi | cert-manager-1.12-webhook | 1.12.16-r6 |
| Wolfi | cilium-1.14 | 1.14.19-r23 |
| Wolfi | cilium-1.14-container-init | 1.14.19-r23 |
| Wolfi | cilium-1.14-container-init-compat | 1.14.19-r23 |
| Wolfi | cilium-1.14-hubble-relay | 1.14.19-r23 |
| Wolfi | cilium-1.14-iptables | 1.14.19-r23 |
| Wolfi | cilium-1.14-operator-generic | 1.14.19-r23 |
| Wolfi | cilium-cli | 0.18.2-r2 |
| Wolfi | cluster-autoscaler-1.28 | 1.28.7-r7 |
| Wolfi | cluster-autoscaler-1.28-compat | 1.28.7-r7 |
| Wolfi | cmctl-1.12 | 1.12.16-r6 |
| Wolfi | cosign-fips | 2.4.3-r5 |
| Wolfi | datadog-cluster-agent | 7.64.1-r0 |
| Wolfi | datadog-cluster-agent-oci-compat | 7.64.1-r0 |
| Wolfi | eksctl | 0.205.0-r4 |
| Wolfi | falcoctl | 0.7.3-r8 |
| Wolfi | ghaudit | 0.4.0-r1 |
| Wolfi | glab | 1.54.0-r0 |
| Wolfi | helm-operator | 1.39.2-r0 |
| Wolfi | helm-operator-compat | 1.39.2-r0 |
| Wolfi | hubble | 1.17.1-r2 |
| Wolfi | hubble-compat | 1.17.1-r2 |
| Wolfi | kine | 0.13.11-r0 |
| Wolfi | ko-fips | 0.17.1-r10 |
| Wolfi | kots | 1.124.8-r0 |
| Wolfi | kots-compat | 1.124.8-r0 |
| Wolfi | kots-symlink-compat | 1.124.8-r0 |
| Wolfi | kubeadm-bootstrap-controller | 1.9.6-r0 |
| Wolfi | kubeflow-access-management | no fix |
| Wolfi | kubeflow-pipelines-apiserver | 2.14.3-r3 |
| Wolfi | kubernetes-csi-node-driver-registrar-2.9 | 2.9.4-r12 |
| Wolfi | kubernetes-csi-node-driver-registrar-2.9-compat | 2.9.4-r12 |
| Wolfi | kubernetes-dashboard | 7.11.1-r1 |
| Wolfi | kubernetes-dashboard-metrics-scraper | 1.2.2-r5 |
| Wolfi | kubernetes-dashboard-metrics-scraper-compat | 1.2.2-r5 |
| Wolfi | kubernetes-dns-node-cache | 1.25.0-r5 |
| Wolfi | kubevela | 1.10.2-r4 |
| Wolfi | kubevela-vela-cli | 1.10.2-r4 |
| Wolfi | kubevela-vela-core | 1.10.2-r4 |
| Wolfi | kubevela-vela-core-compat | 1.10.2-r4 |
| Wolfi | kubewatch | 2.9.0-r7 |
| Wolfi | kwok | 0.6.1-r7 |
| Wolfi | kwokctl | 0.6.1-r7 |
| Wolfi | kyverno-policy-reporter | 3.0.7-r1 |
| Wolfi | kyverno-policy-reporter-compat | 3.0.7-r1 |
| Wolfi | local-path-provisioner | 0.0.31-r3 |
| Wolfi | local-static-provisioner | 2.7.0-r15 |
| Wolfi | local-static-provisioner-compat | 2.7.0-r15 |
| Wolfi | local-volume-node-cleanup | 2.7.0-r15 |
| Wolfi | local-volume-node-cleanup-compat | 2.7.0-r15 |
| Wolfi | melange | 0.23.0-r1 |
| Wolfi | melange-microvm-init | 0.23.0-r1 |
| Wolfi | newrelic-infra-operator | 0.21.6-r3 |
| Wolfi | newrelic-nri-kube-events | 2.11.8-r1 |
| Wolfi | newrelic-nri-statsd | 2.11.0-r0 |
| Wolfi | nodetaint | 0.0.4-r30 |
| Wolfi | nri-discovery-kubernetes | 1.11.0-r0 |
| Wolfi | nri-discovery-kubernetes-compat | 1.11.0-r0 |
| Wolfi | nri-kubernetes | 3.35.0-r0 |
| Wolfi | opentelemetry-collector-contrib | 0.122.0-r1 |
| Wolfi | opentelemetry-collector-contrib-compat | 0.122.0-r1 |
| Wolfi | postgres-operator | 1.14.0-r5 |
| Wolfi | postgres-operator-compat | 1.14.0-r5 |
| Wolfi | prometheus-2.51 | 2.51.2-r48 |
| Wolfi | prometheus-adapter | 0.12.0-r10 |
| Wolfi | pulumi-kubernetes-operator | 1.16.0-r13 |
| Wolfi | rabbitmq-cluster-operator | 2.12.1-r3 |
| Wolfi | rabbitmq-cluster-operator-bitnami-compat | 2.12.1-r3 |
| Wolfi | rabbitmq-cluster-operator-compat | 2.12.1-r3 |
| Wolfi | rabbitmq-cluster-operator-iamguarded-compat | 2.12.1-r3 |
| Wolfi | rabbitmq-messaging-topology-operator | 1.16.0-r4 |
| Wolfi | rabbitmq-messaging-topology-operator-bitnami-compat | 1.16.0-r4 |
| Wolfi | rabbitmq-messaging-topology-operator-compat | 1.16.0-r4 |
| Wolfi | rabbitmq-messaging-topology-operator-iamguarded-compat | 1.16.0-r4 |
| Wolfi | secrets-store-csi-driver-provider-aws | 0.3.11-r32 |
| Wolfi | secrets-store-csi-driver-provider-aws-compat | 0.3.11-r32 |
| Wolfi | secrets-store-csi-driver-provider-azure | 1.6.2-r32 |
| Wolfi | secrets-store-csi-driver-provider-azure-compat | 1.6.2-r32 |
| Wolfi | skaffold | 2.14.2-r0 |
| Wolfi | slsa-verifier | 2.7.0-r3 |
| Wolfi | sonobuoy | 0.57.3-r2 |
| Wolfi | sonobuoy-compat | 0.57.3-r2 |
| Wolfi | spark-operator | 2.1.0-r8 |
| Wolfi | spark-operator-oci-entrypoint | 2.1.0-r8 |
| Wolfi | sparkctl | 2.1.0-r8 |
| Wolfi | spire-agent | 1.11.2-r5 |
| Wolfi | spire-oidc-discovery-provider | 1.11.2-r5 |
| Wolfi | spire-server | 1.11.2-r5 |
| Wolfi | src | 6.1.0-r3 |
| Wolfi | stakater-reloader | 1.3.0-r2 |
| Wolfi | stakater-reloader-compat | 1.3.0-r2 |
| Wolfi | step-issuer | 0.9.8-r0 |
| Wolfi | step-issuer-compat | 0.9.8-r0 |
| Wolfi | stern | 1.32.0-r3 |
| Wolfi | tekton-chains | 0.24.0-r5 |
| Wolfi | tekton-pipelines | 0.69.0-r2 |
| Wolfi | tekton-pipelines-entrypoint | 0.69.0-r2 |
| Wolfi | tekton-pipelines-events | 0.69.0-r2 |
| Wolfi | tekton-pipelines-nop | 0.69.0-r2 |
| Wolfi | tekton-pipelines-resolvers | 0.69.0-r2 |
| Wolfi | tekton-pipelines-sidecarlogresults | 0.69.0-r2 |
| Wolfi | tekton-pipelines-webhook | 0.69.0-r2 |
| Wolfi | tekton-pipelines-workingdirinit | 0.69.0-r2 |
| Wolfi | terraform | 1.5.7-r25 |
| Wolfi | terraform-compat | 1.5.7-r25 |
| Wolfi | terraform-local-provider-config | 1.5.7-r25 |
| Wolfi | thanos-operator-compat | 0.3.7-r26 |
| Wolfi | tigera-operator-1.30 | 1.30.11-r10 |
| Wolfi | tigera-operator-1.31 | 1.31.2-r23 |
| Wolfi | tigera-operator-1.32 | 1.32.13-r7 |
| Wolfi | tkn | 0.40.0-r4 |
| Wolfi | trust-manager | 0.16.0-r2 |
| Wolfi | up | no fix |
| Wolfi | vault-csi-provider | 1.6.0-r2 |
| Wolfi | vault-k8s | 1.6.2-r1 |
| Wolfi | vela-cli | 1.10.2-r4 |
| Wolfi | vela-core | 1.10.2-r4 |
| Wolfi | velero-plugin-for-csi | 0.7.1-r32 |
| Wolfi | velero-plugin-for-csi-compat | 0.7.1-r32 |
| Wolfi | volume-modifier-for-k8s | 0.5.1-r4 |
| Wolfi | zarf | 0.50.0-r0 |
| Wolfi | zot | 2.1.2-r7 |