142 matches found
Medium: cni-plugins
Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...
Important: cni-plugins
Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...
Important: cni-plugins
Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...
Amazon Linux 2 : cni-plugins (ALAS-2025-2882)
The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2882 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare...
Important: cni-plugins
Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...
Important: cni-plugins
Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...
CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3
CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3. A patched version of the package is available...
CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8
CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8. A patched version of the package is available...
AZL-60447 CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
AZL-60502 CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: grpcurl, mage, eksctl, nri-cassandra, nri-mongodb, dask-gateway, buildkitd, kaf, nri-memcached, vite, kubernetes-dashboard-metrics-scraper, grafana-operator, docker-credential-gcr, kyverno-policy-reporter-kyverno-plugin, kubernetes-csi-external-resizer, cortex,...
GHSA-J7VJ-RW65-4V26 vulnerabilities
Vulnerabilities for packages: victoriametrics-fips, wavefront-collector-for-kubernetes, crossplane-provider-aws-cloudfront, addon-resizer, actions-runner-controller-fips, eck-operator-fips, render-template, metacontroller, eck-operator, prometheus-blackbox-exporter-fips, kor,...
GHSA-8XFX-RJ4P-23JM vulnerabilities
Vulnerabilities for packages: victoriametrics-fips, wavefront-collector-for-kubernetes, crossplane-provider-aws-cloudfront, addon-resizer, actions-runner-controller-fips, eck-operator-fips, render-template, metacontroller, eck-operator, prometheus-blackbox-exporter-fips, kor,...
GHSA-3F6R-QH9C-X6MM vulnerabilities
Vulnerabilities for packages: wavefront-collector-for-kubernetes, elvish, actions-runner-controller-fips, eck-operator-fips, render-template, metacontroller, cloud-provider-aws-fips, eck-operator, prometheus-blackbox-exporter-fips, kor, grafana-rollout-operator, prometheus-elasticsearch-exporter,...
Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins (CVE-2024-45338)
The version of application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45338 advisory. - An attacker can craft an input t...
CVE-2024-45338 affecting package cni-plugins for versions less than 1.4.0-2
CVE-2024-45338 affecting package cni-plugins for versions less than 1.4.0-2. A patched version of the package is available...
CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7
CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7. A patched version of the package is available...
CBL Mariner 2.0 Security Update: application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins (CVE-2024-45338)
The version of application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45338 advisory. - An attacker can craft an input t...
AZL-54542 CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...