331 matches found
Information Disclosure
github.com/knative/func is vulnerable to information disclosure. The vulnerability is due to compromised third-party buildpacks which expose their registry credentials or local docker socket to a malicious lifecycle container, which allows remote attackers to access unauthorized information. This...
Denial of Service (DoS)
Overview Affected versions of this package are vulnerable to Denial of Service DoS. This is vulnerable when an input token that is not a UTF-8 bytestring will trigger a CHECK fail in tf.rawops.PyFunc. Details Denial of Service DoS describes a family of attacks, all aimed at making a system...
CVE-2022-41939
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...
Code injection
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...
CVE-2022-41939
CVE-2022-41939 affects knative.dev/func (client library/CLI for Knative functions). The root issue is credential exposure when using third-party function buildpacks, where a compromised buildpack could expose registry credentials or the local Docker socket to a malicious lifecycle container. The ...
CVE-2022-41939 Credential exposure when running third-party builders in knative/func
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...
CVE-2022-41939 Credential exposure when running third-party builders in knative/func
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...
CVE-2022-41939 Credential exposure when running third-party builders in knative/func
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...
CVE-2022-41939
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious "lifecycle" container. This issues has...
Func information leakage vulnerability
Func is Knative open source a client library and CLI that supports the development and deployment of features. An information disclosure vulnerability exists in Func version 1.8.0 and earlier versions. An attacker exploited the vulnerability to cause registry credentials or local docker to be...
CVE-2022-41939: Exposure of Sensitive Information to an Unauthorized Actor
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...
CVE-2022-3967: Improper Neutralization
A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is...
CVE-2022-3967
A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is...
mariadb: server crash in Item_func_in::cleanup/Item::cleanup_processor
MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Itemfuncin::cleanup/Item::cleanupprocessor...
mariadb: assertion failure in sql/item_func.cc
A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/itemfunc.cc:148, affecting availability...
PT-2022-37152
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read crash. Technical details about the crash include the dissect softether ip port, ndpi search softether,...
OSV-2022-588 Heap-use-after-free in wasmtime_runtime::externref::gc::hcbc8e23ae41614fa
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49171 Crash type: Heap-use-after-free WRITE 8 Crash state: wasmtimeruntime::externref::gc::hcbc8e23ae41614fa wasmtimefuzzing::oracles::tableops::$u7b$$u7b$closure$u7d$$u7d$::hd207e5ffb69...
PT-2022-37096
Name of the Vulnerable Software and Affected Versions wasmtime affected versions not specified Description The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This can lead to a crash. The error is specifically ...
wasmtime:table_ops: Heap-use-after-free in wasmtime_setjmp
Project: https://github.com/bytecodealliance/wasmtime.git Detailed Report: https://oss-fuzz.com/testcase?key=5314786413379584 Project: wasmtime Fuzzing Engine: libFuzzer Fuzz Target: tableops Job Type: libfuzzerasanwasmtime Platform Id: linux Crash Type: Heap-use-after-free WRITE 8 Crash Address:...
PT-2022-37039
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read crash. Technical details about the crash include the functions ndpi search dns, check ndpi detection...