CGA-M9C4-MX87-79FQ: aactl
CVSS: UnknownUnknown
Published Date unknownLast modified Date unknown
Status not reported
The data service did not report a status for this record. Only the available sections are shown.Vulnerability summary
CGA-M9C4-MX87-79FQ is a vulnerability in aactl with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
No timeline events recorded.
Description
No description has been published for this record.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Chainguard117 products
- aactl< 0.4.12-r43
- cg< 0.2.193-r1
- chainctl< 0.2.194-r0
- cloudbeat-8.19< 8.19.16-r0
- cloudbeat-9.2< 9.2.8-r20
- cloudbeat-9.3< 9.3.1-r0
- cloudbeat-9.4< 9.4.0-r2
- cloudbeat-fips-8.19< 8.19.16-r0
- cloudbeat-fips-9.3< 9.3.0-r1
- cloudbeat-fips-9.4< 9.4.0-r1
- cosign< 3.0.3-r0
- cosign-fips< 3.0.3-r0
- crossplane-1.20< 1.20.4-r2
- crossplane-2.0< 2.0.6-r2
- crossplane-2.1< 2.1.3-r2
- crossplane-fips-1.20< 1.20.4-r2
- crossplane-fips-2.0< 2.0.6-r2
- crossplane-fips-2.1< 2.1.3-r2
- docker-cli-buildx< 0.31.1-r2
- falcoctl< 0.12.0-r0
- falcoctl-fips< 0.12.1-r0
- flux-source-controller< 1.7.4-r5
- flux-source-controller-fips< 1.7.4-r4
- gh< 2.83.2-r0
- gh-doc< 2.83.2-r0
- gitsign< 0.14.0-r0
- goreleaser< 2.13.3-r0
- image-factory< 0.9.0-r2
- image-factory-fips< 0.9.0-r2
- ko< 0.18.1-r0
- ko-fips< 0.18.1-r0
- kubescape< 3.0.47-r0
- kyverno-1.16< 1.16.2-r2
- kyverno-background-controller-1.16< 1.16.2-r2
- kyverno-background-controller-fips-1.16< 1.16.3-r1
- kyverno-cleanup-controller-1.16< 1.16.2-r2
- kyverno-cleanup-controller-fips-1.16< 1.16.3-r1
- kyverno-cli-1.16< 1.16.2-r2
- kyverno-cli-fips-1.16< 1.16.3-r1
- kyverno-fips-1.16< 1.16.3-r1
- kyverno-init-container-1.16< 1.16.2-r2
- kyverno-init-container-fips-1.16< 1.16.3-r1
- kyverno-notation-aws< 1.1-r26
- kyverno-notation-aws-fips< 1.1-r26
- kyverno-policy-reporter-plugins-kyverno< 0.5.3-r2
- kyverno-policy-reporter-plugins-kyverno-fips< 0.5.3-r1
- kyverno-reports-controller-1.16< 1.16.2-r2
- kyverno-reports-controller-fips-1.16< 1.16.3-r1
- neuvector-sigstore-interface< 0_git20251212-r0
- neuvector-sigstore-interface-fips< 0_git20251212-r0
- policy-controller< 0.15.1-r0
- policy-controller-fips< 0.15.1-r0
- policy-controller-tester< 0.15.1-r0
- policy-controller-tester-fips< 0.15.1-r0
- ratify< 1.4.3-r0
- ratify-fips< 1.4.3-r0
- sigstore-scaffolding< 0.7.31-r3
- sigstore-scaffolding-cloudsqlproxy< 0.7.31-r3
- sigstore-scaffolding-ctlog-createctconfig< 0.7.31-r3
- sigstore-scaffolding-ctlog-managectroots< 0.7.31-r3
- sigstore-scaffolding-ctlog-verifyfulcio< 0.7.31-r3
- sigstore-scaffolding-fips< 0.7.31-r3
- sigstore-scaffolding-fips-cloudsqlproxy< 0.7.31-r3
- sigstore-scaffolding-fips-ctlog-createctconfig< 0.7.31-r3
- sigstore-scaffolding-fips-ctlog-managectroots< 0.7.31-r3
- sigstore-scaffolding-fips-ctlog-verifyfulcio< 0.7.31-r3
- sigstore-scaffolding-fips-fulcio-createcerts< 0.7.31-r3
- sigstore-scaffolding-fips-getoidctoken< 0.7.31-r3
- sigstore-scaffolding-fips-rekor-createsecret< 0.7.31-r3
- sigstore-scaffolding-fips-trillian-createdb< 0.7.31-r3
- sigstore-scaffolding-fips-trillian-createtree< 0.7.31-r3
- sigstore-scaffolding-fips-trillian-updatetree< 0.7.31-r3
- sigstore-scaffolding-fips-tsa-createcertchain< 0.7.31-r3
- sigstore-scaffolding-fips-tuf-createsecret< 0.7.31-r3
- sigstore-scaffolding-fips-tuf-server< 0.7.31-r3
- sigstore-scaffolding-fulcio-createcerts< 0.7.31-r3
- sigstore-scaffolding-getoidctoken< 0.7.31-r3
- sigstore-scaffolding-rekor-createsecret< 0.7.31-r3
- sigstore-scaffolding-trillian-createdb< 0.7.31-r3
- sigstore-scaffolding-trillian-createtree< 0.7.31-r3
- sigstore-scaffolding-trillian-updatetree< 0.7.31-r3
- sigstore-scaffolding-tsa-createcertchain< 0.7.31-r3
- sigstore-scaffolding-tuf-createsecret< 0.7.31-r3
- sigstore-scaffolding-tuf-server< 0.7.31-r3
- skaffold< 2.17.1-r0
- skaffold-fips< 2.17.1-r0
- spire-agent< 1.14.0-r1
- spire-agent-fips< 1.14.0-r1
- tekton-chains< 0.26.0-r3
- tekton-chains-fips< 0.26.0-r5
- teleport-17< 17.7.23-r0
- teleport-17-kube-agent-updater< 17.7.23-r0
- teleport-17-operator< 17.7.23-r0
- teleport-18< 18.7.6-r0
- teleport-18-kube-agent-updater< 18.7.6-r0
- teleport-18-kube-agent-updater-compat< 18.7.2-r12
- teleport-18-operator< 18.7.6-r0
- teleport-18-operator-compat< 18.7.2-r12
- teleport-18.6< 18.6.8-r9
- teleport-18.6-kube-agent-updater< 18.6.8-r9
- teleport-18.6-operator< 18.6.8-r9
- teleport-operator-fips-17< 17.7.13-r1
- teleport-operator-fips-18< 18.6.1-r1
- tflint< 0.60.0-r3
- tflint-compat< 0.60.0-r3
- tflint-fips< 0.60.0-r3
- tflint-fips-compat< 0.60.0-r3
- tkn< 0.43.0-r7
- tkn-fips< 0.43.0-r3
- trivyAll versions (No fix recorded)
- trivy-fipsAll versions (No fix recorded)
- trivy-operatorAll versions (No fix recorded)
- trivy-operator-fipsAll versions (No fix recorded)
- vexctl< 0.4.1-r4
- witness< 0.10.1-r4
- zarf< 0.68.1-r0
- zot< 2.1.14-r0
Wolfi52 products
- aactl< 0.4.12-r43
- cosign< 3.0.3-r0
- crossplane-2.1< 2.1.3-r2
- docker-cli-buildx< 0.31.1-r2
- falcoctl< 0.12.0-r0
- flux-source-controller< 1.7.4-r5
- gh< 2.83.2-r0
- gh-doc< 2.83.2-r0
- gitsign< 0.14.0-r0
- goreleaser< 2.13.3-r0
- ko< 0.18.1-r0
- kubescape< 3.0.47-r0
- kyverno-1.16< 1.16.2-r2
- kyverno-background-controller-1.16< 1.16.2-r2
- kyverno-cleanup-controller-1.16< 1.16.2-r2
- kyverno-cli-1.16< 1.16.2-r2
- kyverno-init-container-1.16< 1.16.2-r2
- kyverno-notation-aws< 1.1-r26
- kyverno-reports-controller-1.16< 1.16.2-r2
- neuvector-sigstore-interface< 0_git20251212-r0
- policy-controller< 0.15.1-r0
- policy-controller-tester< 0.15.1-r0
- ratify< 1.4.3-r0
- sigstore-scaffolding< 0.7.31-r3
- sigstore-scaffolding-cloudsqlproxy< 0.7.31-r3
- sigstore-scaffolding-ctlog-createctconfig< 0.7.31-r3
- sigstore-scaffolding-ctlog-managectroots< 0.7.31-r3
- sigstore-scaffolding-ctlog-verifyfulcio< 0.7.31-r3
- sigstore-scaffolding-fulcio-createcerts< 0.7.31-r3
- sigstore-scaffolding-getoidctoken< 0.7.31-r3
- sigstore-scaffolding-rekor-createsecret< 0.7.31-r3
- sigstore-scaffolding-trillian-createdb< 0.7.31-r3
- sigstore-scaffolding-trillian-createtree< 0.7.31-r3
- sigstore-scaffolding-trillian-updatetree< 0.7.31-r3
- sigstore-scaffolding-tsa-createcertchain< 0.7.31-r3
- sigstore-scaffolding-tuf-createsecret< 0.7.31-r3
- sigstore-scaffolding-tuf-server< 0.7.31-r3
- skaffold< 2.17.1-r0
- spire-agent< 1.14.0-r1
- tekton-chains< 0.26.0-r3
- teleport-18.6< 18.6.8-r9
- teleport-18.6-kube-agent-updater< 18.6.8-r9
- teleport-18.6-operator< 18.6.8-r9
- tflint< 0.60.0-r3
- tflint-compat< 0.60.0-r3
- tkn< 0.43.0-r7
- trivyAll versions (No fix recorded)
- trivy-operatorAll versions (No fix recorded)
- vexctl< 0.4.1-r4
- witness< 0.10.1-r4
- zarf< 0.68.1-r0
- zot< 2.1.14-r0
2 vendors · 169 products
References
0 linksNo references have been published for this record.
Related vulnerabilities
CVE-2025-54059chainguardcg+20.14%melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange in apks had file system permissions mode 666. This potentially allows an unprivileged user to tamper with apk SBOMs on a running image, potentially confusing security scanners. An attacker could also perform a DoS under special circumstances. Version 0.29.5 fixes the issue.CVE-2025-54410chainguardaactl+4390.15%Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected.
Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticipate a fix for this issue in version 25.0.13.CVE-2025-54388chainguardagentbeat-fips+1910.23%Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.CVE-2025-52881chainguardamazon-k8s-cni-fips+5540.57%runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with shared mounts (we have also verified this attack is possible to exploit using a standard Dockerfile with docker buildx build as that also permits triggering parallel execution of containers with custom shared mounts configured). This redirect could be through symbolic links in a tmpfs or theoretically other methods such as regular bind-mounts. While similar, the mitigation applied for the related CVE, CVE-2019-19921, was fairly limited and effectively only caused runc to verify that when LSM labels are written they are actually procfs files. This issue is fixed in versions 1.2.8, 1.3.3, and 1.4.0-rc.3.CVE-2025-61729chainguardaactl+25900.46%Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.CVE-2025-65965anchoregrype+80.15%Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 through 0.104.0. If registry credentials are defined and the output of grype is written using the --file or --output json=<file> option, the registry credentials will be included unsanitized in the output file. This issue has been patched in version 0.104.1. Users running affected versions of grype can work around this vulnerability by redirecting stdout to a file instead of using the --file or --output options.