271 matches found
AZL-35437 CVE-2023-45142 affecting package docker-buildx for versions less than 0.14.0-1
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...
AZL-31325 CVE-2023-44487 affecting package moby-buildx for versions less than 0.7.1-14
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
AZL-35436 CVE-2023-44487 affecting package docker-buildx for versions less than 0.14.0-1
The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...
SUSE-SU-2023:3536-1 Security update for docker
This update for docker fixes the following issues: - Update to Docker 24.0.5-ce. See upstream changelong online at bsc1213229 - Update to Docker 24.0.4-ce. See upstream changelog online at . bsc1213500 - Update to Docker 24.0.3-ce. See upstream changelog online at . bsc1213120 - Recommend...
Buildkit credentials inlined to Git URLs could end up in provenance attestation
When the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1 Invoking build directly from a URL...
GHSA-GC89-7GCR-JXQC Buildkit credentials inlined to Git URLs could end up in provenance attestation
When the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation. Git URL can be passed in two ways: 1 Invoking build directly from a URL...
AZL-43344 CVE-2021-43565 affecting package moby-buildx for versions less than 0.7.1-20
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server...
AZL-33614 CVE-2022-21698 affecting package moby-buildx for versions less than 0.7.1-16
clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients. In clientgolang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and...
AZL-33613 CVE-2021-44716 affecting package moby-buildx for versions less than 0.7.1-18
net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...
CVE-2020-27534 affecting package moby-buildx 0.4.1-3
CVE-2020-27534 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...
CVE-2019-13139 affecting package moby-buildx 0.4.1-3
CVE-2019-13139 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...
CVE-2014-5277 affecting package moby-buildx 0.4.1-3
CVE-2014-5277 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...
CVE-2015-3627 affecting package moby-buildx 0.4.1-3
CVE-2015-3627 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...
CVE-2014-8179 affecting package moby-buildx 0.4.1-3
CVE-2014-8179 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...
CVE-2014-0048 affecting package moby-buildx 0.4.1-3
CVE-2014-0048 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...
CVE-2017-14992 affecting package moby-buildx 0.4.1-3
CVE-2017-14992 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...
CVE-2014-5282 affecting package moby-buildx 0.4.1-3
CVE-2014-5282 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...
CVE-2021-21285 affecting package moby-buildx 0.4.1-3
CVE-2021-21285 affecting package moby-buildx 0.4.1-3. An upgraded version of the package is available that resolves this issue...