VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/openshift/source-to-image: vulnerability history, versions and safety

github.com/openshift/source-to-image is a package in the Go ecosystem. Vulert records 2 vulnerabilities for it across 120 releases, from Apr 2021 to Feb 2023. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
2 vulnerabilities recorded M1 U1
i
0 with no fix published

Every vulnerability has a patched version to move to.

i
0 in the last 12 months

Nothing new recorded in the last year.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/openshift/source-to-image vulnerabilities

Vulert verdict on github.com/openshift/source-to-image v1.6.4 i

Updated on 23 Oct 2026

Action needed: v1.6.4 has 2 known vulnerabilities, but every one of them has a fix. Upgrade to the version listed below and you are clear.

Package health score 84/100
  • Security Minor issues
  • Maintenance Sustainable
  • Popularity Key ecosystem project
  • Community Moderate

What to do: Upgrade to the version that resolves each vulnerability below. Fix it, then keep watch: this version is affected today, and the next one may be too — Vulert alerts you when a new vulnerability lands. Monitor it with Vulert →

  • Current release v1.6.4 — affected i
  • Vulnerabilities on record 2 over 1 year · 0 in the last year i
  • Latest disclosure 06 Feb 2023 i
  • Highest CVSS 6.5 i
  • With no published fix 0 i
  • Stars 2,544 i
  • OpenSSF scorecard 3/10 i
  • Last release 1 month ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/openshift/source-to-image, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v1.6.5-0.20260923134615-1fc6ef0a04d0 23 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.4 22 Sep 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.4-0.20260817113106-b16cef31e888 17 Aug 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.3 22 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.3-0.20260716100253-a4a1286f6c53 16 Jul 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.2 02 Jun 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.2-0.20260602170225-739248cef2cd 02 Jun 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.3-0.20260602170225-739248cef2cd 02 Jun 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.2-0.20260526114449-13aff8510c47 26 May 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.2-0.20260403142012-0408bf427f51 03 Apr 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.2-0.20260312093505-59d4bbda1a85 12 Mar 2026 M1 U1 Apache-2.0 Yes Details →
v1.6.1 11 Mar 2026 M1 U1 Apache-2.0 Yes Details →
v1.5.2-0.20260217105202-7bf8815a36f6 17 Feb 2026 M1 U1 Apache-2.0 Yes Details →
v1.5.2-0.20251104092637-45635f9ec80d 04 Nov 2025 M1 U1 Apache-2.0 Yes Details →
v1.5.2-0.20251017160619-cfb91cb8a989 17 Oct 2025 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20250828205347-f1063e52ddd5 28 Aug 2025 M1 U1 Apache-2.0 Yes Details →
v1.5.2-0.20250828205347-f1063e52ddd5 28 Aug 2025 M1 U1 Apache-2.0 Yes Details →
v1.5.2-0.20250701135808-a9e232d12776 01 Jul 2025 M1 U1 Apache-2.0 Yes Details →
v1.5.1 02 Jun 2025 M1 U1 Apache-2.0 Yes Details →
v1.6.0 02 Jun 2025 M1 U1 Apache-2.0 Yes Details →
v1.5.0 13 Jan 2025 M1 U1 Apache-2.0 Yes Details →
v1.4.1-0.20241111002307-9dc3cee2f544 11 Nov 2024 M1 U1 Apache-2.0 Yes Details →
v1.4.1-0.20240812142311-9d6afb7881c3 12 Aug 2024 M1 U1 Apache-2.0 Yes Details →
v1.4.1-0.20240709152423-fb95f6c726f0 09 Jul 2024 M1 U1 Apache-2.0 Yes Details →
v1.4.1-0.20240701153626-f9ccd70d1796 01 Jul 2024 M1 U1 Apache-2.0 Yes Details →
v1.4.1-0.20240605122348-f94ff357628b 05 Jun 2024 M1 U1 Apache-2.0 Yes Details →
v1.4.1-0.20240516041539-bf52fc02204e 16 May 2024 M1 U1 Apache-2.0 Yes Details →
v1.3.10-0.20240312114258-d3544c7ee645 12 Mar 2024 M1 U1 Apache-2.0 Yes Details →
v1.4.0 12 Mar 2024 M1 U1 Apache-2.0 Yes Details →
v1.3.10-0.20240223163641-625a537d6c7c 23 Feb 2024 M1 U1 Apache-2.0 Yes Details →
v1.3.10-0.20240204024446-d7a50797cf86 04 Feb 2024 M1 U1 Apache-2.0 Yes Details →
v1.3.10-0.20240102042244-aab0ed726b47 02 Jan 2024 M1 U1 Apache-2.0 Yes Details →
v1.3.9 18 Oct 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.9-0.20230920184653-5bd486ef3bdd 20 Sep 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.8 06 Jul 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.7 04 Jul 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.7-0.20230412154053-01312890680b 12 Apr 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.6 04 Apr 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.6-0.20230404163006-cd7d7ce9fd75 04 Apr 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.6-0.20230316073401-9b631251994a 16 Mar 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.5 15 Mar 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.4 12 Mar 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.3 12 Mar 2023 M1 U1 Apache-2.0 Yes Details →
v1.3.2 10 Dec 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20221207172107-a1dbe56ef487 07 Dec 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220708211609-a364722d1db0 08 Jul 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220708205834-c8dd2dc2cc64 08 Jul 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220707160822-bf32af469c0c 07 Jul 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220707142727-81bf759032b9 07 Jul 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220707125322-5d16780746ca 07 Jul 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220629195935-01d9d0362cdd 29 Jun 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220629195935-46b21861b8c5 29 Jun 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220629195935-a9726865b2e1 29 Jun 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220629195935-ebacea9f3edc 29 Jun 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220629195857-759107145a3c 29 Jun 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220629195857-e72ed0c67f9b 29 Jun 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220629195147-331ea6eb5b30 29 Jun 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220516191958-4feceb762634 16 May 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20220516184757-8835f6310683 16 May 2022 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211124201032-11b93c276d36 24 Nov 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211110130116-ae227b3792b5 10 Nov 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211109224528-0a57243e7fdd 09 Nov 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211109213901-aa690147cc80 09 Nov 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211018131846-48a9c056cfde 18 Oct 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211018125130-fcacdb07b2c3 18 Oct 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211013191015-31e63d72bbea 13 Oct 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211013184012-cc5438d25d60 13 Oct 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211013173940-24fd77722e4a 13 Oct 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20211012232238-6d698a370125 12 Oct 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20210722133724-30aa3ffabc5e 22 Jul 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20210719201059-4f4cb8b11f98 19 Jul 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20210712190155-50f0f4feaba5 12 Jul 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20210702204405-a5a9da729a5e 02 Jul 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20210702201555-6abec9f4fc68 02 Jul 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20210702195015-ed1f0ecedc5e 02 Jul 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20210629193030-12a00f2b743b 29 Jun 2021 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20201012153926-30d81a9440f3 12 Oct 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.2-0.20201010194740-9310b6889b89 10 Oct 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1 09 Oct 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20201009175615-af408da20ab3 09 Oct 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20201006200901-8fdb399575f7 06 Oct 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20201006190521-129c90e36fec 06 Oct 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20201002152055-2ed02f2351b4 02 Oct 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20201002005950-8ca83f8ce181 02 Oct 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20201002005935-aa7e3310e91f 02 Oct 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200922234934-0b4cb63090fb 22 Sep 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200916175311-b8a480489b60 16 Sep 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200916165904-cd2d6c071042 16 Sep 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200617194140-aca6e1b30336 17 Jun 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200617065431-ac8e27b1529c 17 Jun 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200617065412-eb882f4c53e7 17 Jun 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200605131534-49df53861a88 05 Jun 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200605071711-8523a8a965dd 05 Jun 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200604154310-379093df2be3 04 Jun 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200602182957-adfc3ee2f40d 02 Jun 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200428192123-927f64aa9238 28 Apr 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200423153002-99fc84ec0735 23 Apr 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200423091712-eb0455a3313f 23 Apr 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200414122917-01e826405fe4 14 Apr 2020 M1 U1 Apache-2.0 Yes Details →
v1.3.1-0.20200414083955-cfc576a424ae 14 Apr 2020 M1 U1 Apache-2.0 Yes Details →
v0.0.0-20200213141744-eed2850f2187 13 Feb 2020 M1 U1 — Yes Details →
v1.3.1-0.20200213141744-eed2850f2187 13 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200213112054-98b1e01118d6 13 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200212143615-cbcefe1f18d8 12 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200210121758-820f21584e5e 10 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200210121608-fb0be78c7f00 10 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200210121539-888560cf0d71 10 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200207144752-cb94360b4771 07 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200207144738-a4a8b1114ca2 07 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200207144715-38d86ba41a23 07 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200207144648-a9c3f7ff0621 07 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200207094703-e2ce9613d1e1 07 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200207094136-ec4d738875a9 07 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200205152125-ecf5524df96e 05 Feb 2020 M1 U1 — Yes Details →
v1.3.0 05 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200205133727-b178763a306e 05 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200204174312-8d283675241f 04 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200204162732-4b18759b5270 04 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200204153829-cd7c074ccf40 04 Feb 2020 M1 U1 — Yes Details →
v1.2.1-0.20200204144947-d491c49336f9 04 Feb 2020 M1 U1 — Yes Details →

The newest 120 of 1,568 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2023 1

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 0 of the 2 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/openshift/source-to-image

The 2 most severe of 2 vulnerabilities recorded for this package

Search all 2 in the database →
Vulnerability Severity Fixed version ↑ Disclosed ↑
CVE-2018-1103: Openshift Enterprise source-to-image Arbitrary File Write via Archive Extraction (Zip Slip) 6.5 medium 1.1.10-0.20180427153919-f5cbcbc5cc6f 06 Feb 2023
CVE-2018-1103: Arbitrary file write via archive extraction in github.com/openshift/source-to-image N/A unrated 1.1.10-0.20180427153919-f5cbcbc5cc6f 14 Apr 2021

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/openshift/source-to-image

Is github.com/openshift/source-to-image safe to use?

Vulert records 2 vulnerabilities for github.com/openshift/source-to-image in Go: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. Every one of them has a published fix, so the practical answer is to run a supported release and keep it patched.

What is github.com/openshift/source-to-image's Vulert package health score?

Vulert scores github.com/openshift/source-to-image 84/100, which reads as in good shape. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15).

Is the latest version of github.com/openshift/source-to-image affected?

Yes. v1.6.4, the version you would install today, has 2 known vulnerabilities, and every one of them has a published fix. Upgrade to the version listed for each.

Which version of github.com/openshift/source-to-image should I use?

v1.6.4 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/openshift/source-to-image have?

2 vulnerabilities are recorded for github.com/openshift/source-to-image in the Go ecosystem: 0 critical, 0 high, 1 medium and 0 low, plus 1 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/openshift/source-to-image vulnerabilities disclosed?

0 vulnerabilities were recorded for github.com/openshift/source-to-image in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/openshift/source-to-image are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/openshift/source-to-image for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/openshift/source-to-image version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.