https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 03:56:54 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-241175 EUVD-2026-241175 https://cve.radiocsirt.org/vuln/euvd-2026-241175 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48374 <p>zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.</p> <p>zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f), when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup. Version 2.1.3 (corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f) fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-48374 https://cve.radiocsirt.org/vuln/ghsa-c37v-3c8w-crq8 <p><strong>Affected:</strong> Go: zotregistry.dev/zot</p> <p>### Summary When using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup.</p> <p>### Details Container Image (15.04.2025): ghcr.io/project-zot/zot-linux-amd64:latest Here is an example how the configuration can look which causes the above stated problem:</p> <p>` http: address: &#34;0.0.0.0&#34; port: 5000 externalUrl: &#34;https://zot.example.com&#34; auth: { failDelay: 1, openid: { providers: { oidc: { name: &#34;Keycloak&#34;, clientid: &#34;zot-client-id&#34;, clientsecret: fsdfkmmiwljasdklfsjaskldjfkljewijrf234i52k3j45l, keypath: &#34;&#34;, issuer: &#34;https://keycloak.example.com/realms/example&#34;, scopes: [&#34;openid&#34;] } } } } `</p> <p>### PoC Set up a blank new zot k8s deployment with the code snippet above.</p> <p>### Impact exposure of secrets, on configuring a oidc provider</p> <p><strong>Affected:</strong> Go: zotregistry.dev/zot</p> <p>### Summary When using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout logs for an example at container startup.</p> <p>### Details Container Image (15.04.2025): ghcr.io/project-zot/zot-linux-amd64:latest Here is an example how the configuration can look which causes the above stated problem:</p> <p>` http: address: &#34;0.0.0.0&#34; port: 5000 externalUrl: &#34;https://zot.example.com&#34; auth: { failDelay: 1, openid: { providers: { oidc: { name: &#34;Keycloak&#34;, clientid: &#34;zot-client-id&#34;, clientsecret: fsdfkmmiwljasdklfsjaskldjfkljewijrf234i52k3j45l, keypath: &#34;&#34;, issuer: &#34;https://keycloak.example.com/realms/example&#34;, scopes: [&#34;openid&#34;] } } } } `</p> <p>### PoC Set up a blank new zot k8s deployment with the code snippet above.</p> <p>### Impact exposure of secrets, on configuring a oidc provider</p> https://cve.radiocsirt.org/vuln/ghsa-c37v-3c8w-crq8 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15179-1 <p>govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250527T204717-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15179-1