Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.10.60 security update

Red Hat OpenShift Container Platform release 4.10.60 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a security impact of...

CVE-2021-25749

CVE-2021-25749 affects Windows workloads in Kubernetes: workloads can run as ContainerAdministrator even when runAsNonRoot is set to true. The entry documents a locally exploitable condition with a CVSS v3.1 base score of 7.8 (HIGH) and a local attack vector with privileges required LOW, no user ...

CVE-2023-1944 [minikube] ssh server with default password

This vulnerability enables ssh access to minikube container using a default password...

CVE-2023-1944

CVE-2023-1944 affects minikube. The issue enables SSH access to the minikube container using a default password due to hard-coded/default credentials, leading to potential local privilege/escalation as described by multiple sources (NVD/Veracode/SUSE/CVE lists). Exploitation details are not provi...

CVE-2023-1944 [minikube] ssh server with default password

This vulnerability enables ssh access to minikube container using a default password...

Oracle Linux 8 : container-tools:4.0 (ELSA-2023-2802)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2802 advisory. - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closin...

There’s Finally a Way to Improve Cloud Container Registry Security

“Container registries” are ubiquitous software clearinghouses, but they’ve been exposed for years. Chainguard says it now has a solution...

Security Bulletin: Multiple Security Vulnerabilities have been fixed in the IBM Directory Server and IBM Directory Suite products (CVE-2022-22476, CVE-2022-34165)

Summary Multiple Security Vulnerabilities in the IBM WebSphere Application Server product as shipped with the IBM Directory Server and IBM Directory Suite products have been fixed. Vulnerability Details CVEID:CVE-2022-22476 DESCRIPTION: IBM WebSphere Application Server Liberty 17.0.0.3 through...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and IntegrationServer operands may be vulnerable to denial of service due to [CVE-2012-0881], [CVE-2013-4002] and [CVE-2022-23437]

Summary Apache Xerces is not used by IBM App Connect Enterprise Certified Container but was present in an image. IBM App Connect Enterprise Certified Container DesignerAuthoring and IntegrationServer operands may be vulnerable to denial of service. This bulletin provides patch information to...

USN-6088-2: runC vulnerabilities

USN-6088-1 fixed vulnerabilities in runC. This update provides the corresponding updates for Ubuntu 16.04 LTS. It was discovered that runC incorrectly performed access control when mounting /proc to non-directories. An attacker could possibly use this issue to escalate privileges. CVE-2019-19921...

Information Disclosure

github.com/ibm-messaging/mq-container is vulnerable to Information Disclosure. The vulnerability allows a local user to obtain sensitive credential information when a detailed technical error message is returned in a stack trace, resulting in the disclosure of sensitive information...

Ubuntu 16.04 ESM : runC vulnerabilities (USN-6088-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6088-2 advisory. USN-6088-1 fixed vulnerabilities in runC. This update provides the corresponding updates for Ubuntu 16.04 LTS. It was discovered that runC incorrectly...

container-tools:ol8 security, bug fix, and enhancement update

...

container-tools:4.0 security and bug fix update

...

CentOS 8 : container-tools:rhel8 (CESA-2023:2758)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2023:2758 advisory. - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling i...

RHEL 8 : container-tools:rhel8 (RHSA-2023:2758)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:2758 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang:...

Cisco DNA Center Information Disclosure Vulnerability (CNVD-2023-62938)

Cisco DNA Center is a network management and command center service from Cisco USA. An information disclosure vulnerability exists in Cisco DNA Center. The vulnerability stems from improper authorization of API requests and can be exploited by an authenticated, remote attacker to read information...

AlmaLinux 8 : container-tools:4.0 (ALSA-2023:2802)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:2802 advisory. golang: net/http: improper sanitization of Transfer-Encoding header CVE-2022-1705 golang: go/parser: stack exhaustion in all Parse functions CVE-2022-1962...

Moderate: Red Hat Security Advisory: Red Hat build of Cryostat 2.3.0: new RHEL 8 container images

New Red Hat build of Cryostat 2.3.0 on RHEL 8 container images are now available New Red Hat build of Cryostat 2.3.0 on RHEL 8 container images have been released, adding a variety of features and bug fixes. Users of the Red Hat build of Cryostat 2.2.1 on RHEL 8 container images are advised to...

USN-6088-1: runC vulnerabilities

It was discovered that runC incorrectly made /sys/fs/cgroup writable when in rootless mode. An attacker could possibly use this issue to escalate privileges. CVE-2023-25809 It was discovered that runC incorrectly performed access control when mounting /proc to non-directories. An attacker could...