RHSA-2024:2892 Red Hat Security Advisory: go-toolset-1.19-golang security update

Bulletin has no description...

RHSA-2024:1468 Red Hat Security Advisory: go-toolset-1.19-golang security update

Bulletin has no description...

RHSA-2023:3920 Red Hat Security Advisory: go-toolset-1.19 and go-toolset-1.19-golang security update

Bulletin has no description...

GO-2022-0405 Potential privilege escalation on Kubernetes >= v1.19 when the Argo Sever is run with `--auth-mode=client` in github.com/argoproj/argo-workflows

Potential privilege escalation on Kubernetes = v1.19 when the Argo Sever is run with --auth-mode=client in github.com/argoproj/argo-workflows...

PT-2024-29581 · Starship · Starship

Name of the Vulnerable Software and Affected Versions: Starship versions 1.0.0 through 1.19.x Description: Starship is a cross-shell prompt that has undocumented and unpredictable shell expansion and/or quoting rules, making it easy to accidentally cause shell injection when using custom commands...

OPENSUSE-SU-2024:10340-1 lcms-1.19-19.8 on GA media

These are all security issues fixed in the lcms-1.19-19.8 package on the GA media of openSUSE Tumbleweed...

RHEL 7 : go-toolset-1.19-golang (RHSA-2024:2892)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2892 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: net/http,...

GHSA-HJ3V-M684-V259 vulnerabilities

Vulnerabilities for packages: falcoctl-fips, falcoctl, spire-server, mc-fips, boring-registry-fips, mc, boring-registry, minio, minio-fips, spire-server-fips, external-secrets-fips...

GHSA-V53G-5GJP-272R vulnerabilities

Vulnerabilities for packages: eksctl, cilium-cli, flux-helm-controller, trivy, flux-source-controller, helm-push, k9s, zot, zarf, up, kubevela, helm-operator, kots, kubescape, chartmuseum, k8sgpt...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: eksctl, chartmuseum, helm, k9s, ko-fips, kots, nerdctl, policy-controller-fips, crane, loki, flux, buildkitd, docker-machine-driver-harvester, argo-workflows, up, policy-controller, flux-image-reflector-controller, kargo, cadvisor-fips, zarf, bom, slsa-verifier,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: eksctl, chartmuseum, helm, k9s, ko-fips, kots, nerdctl, policy-controller-fips, crane, loki, flux, buildkitd, docker-machine-driver-harvester, argo-workflows, up, policy-controller, flux-image-reflector-controller, kargo, cadvisor-fips, zarf, bom, slsa-verifier,...

CVE-2024-21664 vulnerabilities

Vulnerabilities for packages: boring-registry, gitsign, minio, vexctl, mc, tekton-chains, spire-server, kubescape, falcoctl...

CVE-2023-49290 vulnerabilities

Vulnerabilities for packages: gitsign, falcoctl-fips, falcoctl, vexctl, kubescape, tekton-chains, cosign-fips...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, ip-masq-agent, prometheus-adapter, aws-ebs-csi-driver, nodetaint, spark-operator, kubernetes-dns-node-cache, aws-efs-csi-driver-fips...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, ip-masq-agent, prometheus-adapter, aws-ebs-csi-driver, nodetaint, spark-operator, kubernetes-dns-node-cache, aws-efs-csi-driver-fips...

free5GC udm vulnerable to Invalid Curve Attack

pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...

GHSA-CQVV-R3G3-26RF free5GC udm vulnerable to Invalid Curve Attack

pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...

CVE-2023-46324

pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its...

RHEL 7 : go-toolset-1.19 and go-toolset-1.19-golang (RHSA-2023:5719)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5719 advisory. Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: golang: net/http,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: amass, nginx-mainline, nodetaint, pulumi-kubernetes-operator, gke-gcloud-auth-plugin, metrics-server, ip-masq-agent, weaviate, frp, nri-prometheus, ollama, minio, hugo, secrets-store-csi-driver, git-lfs, grype, hey, envoy-ratelimit, flux-kustomize-controller, gobuste...