CVE-2021-31999

A Reliance on Untrusted Inputs in a Security Decision vulnerability in Rancher allows users in the cluster to act as others users in the cluster by forging the "Impersonate-User" or "Impersonate-Group" headers. This issue affects: Rancher versions prior to 2.5.9. Rancher versions prior to 2.4.16...

PT-2021-16518

Name of the Vulnerable Software and Affected Versions: Rancher versions prior to 2.5.9 Rancher versions prior to 2.4.16 Description: An Improper Access Control issue in Rancher allows users in the cluster to make requests to cloud providers by creating requests with the cloud-credential ID, and...

Red Hat OpenShift has unexplained holes

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat that supports building, testing, deploying, and running applications.A security vulnerability exists in versions prior to OpenShift version 4.8, which stems from a certificate generated by a service CA within ...

CVE-2021-3636

It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional certificates. The Service CA is automatically mounted into all pods, allowing them to safely connect to trusted in-cluster services that present certificate...

Red Hat OpenShift 授权问题漏洞

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat that supports building, testing, deploying, and running applications.A security vulnerability exists in versions prior to OpenShift version 4.8, which stems from a certificate generated by a service CA within ...

July 13, 2021—KB5004307 (Security-only update)

None None...

July 13, 2021—KB5004285 (Security-only update)

None None...

July 13, 2021—KB5004298 (Monthly Rollup)

None None...

July 13, 2021—KB5004294 (Monthly Rollup)

None None...

File Upload Vulnerability in Library Cluster Management System of Guangzhou Tutron Computer Software Development Co. Ltd (CNVD-2021-52386)

Ltd. is a high-tech enterprise integrating product research and development, application integration and customer service, with the main goal of providing high-quality application software system design, integration and maintenance services for users in the library industry. There is a file uploa...

SQL Injection Vulnerability in interlib Library Cluster Management System

Guangzhou Tutron Computer Software Development Co., Ltd. is a high-tech enterprise integrating product development, application integration and customer service. A SQL injection vulnerability exists in the interlib library cluster management system, which can be exploited by attackers to obtain...

IBM Event Streams 安全漏洞

IBM Event Streams is a set of event streaming platform based on Apache Kafka project from IBM, USA. The platform is primarily used for Apache Kafka deployment, authentication and encrypted communication functions. A security vulnerability exists in IBM Event Streams that allows users to create...

Arbitrary File Deletion Vulnerability in Library Cluster Management System of Guangzhou Tutron Computer Software Development Co.

Guangzhou Tutron Computer Software Development Co., Ltd. is a high-tech enterprise integrating product development, application integration and customer service. There is an arbitrary file deletion vulnerability in the Library Cluster Management System of Guangzhou Tutron Computer Software...

Low: Red Hat Enhancement Advisory: ACS 3.62 enhancement update

Red Hat Advanced Cluster security releases a new Operator to simplify installation and accelerate security use cases. To accelerate implementation of security use cases the Red Hat Advanced Cluster security team has released a new Operator as the primary source of installation on OpenShift 4.6 an...

Command Execution Vulnerability in Guangdong Todi Elib 4.1 Library Cluster Management System

Ltd. is a high-tech company, hereinafter referred to as "TODI Technology", has been engaged in the library management software research and development, and library RFID self-service equipment research and development and manufacturing, to provide library RFID system solutions. Guangdong toppy...

The vulnerability of the Crmsh cluster’s management layer lies in the lack of a mechanism for managing privileges. This allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Crmsh cluster management interface is related to the lack of a mechanism for managing privileges. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

RHEL 7 / 8 : OpenShift Container Platform 4.7.19 (RHSA-2021:2555)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2555 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

OESA-2021-1250 mariadb security update

MariaDB turns data into structured information in a wide array of applications, ranging from banking to websites. It is an enhanced, drop-in replacement for MySQL. MariaDB is used because it is fast, scalable and robust, with a rich ecosystem of storage engines, plugins and many other tools make ...

corosync: Denial of service

Background The Corosync Cluster Engine is a Group Communication System with additional features for implementing high availability within applications. Description It was discovered that corosync allowed an unauthenticated user to cause a Denial of Service by application crash. Impact A remote...

Beware password-spraying fancy bears

The NSA, FBI, and CISA, in cooperation with the UKs National Cyber Security Centre NCSC, have issued a report that describes in detail why, and how, they think that a Russian military unit is behind large-scale brute-force attacks on the cloud-IT resources of government and private sector compani...