GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: vgpu-util, gitlab-cng, flux-source-controller-fips, aws-privateca-issuer-fips, rke2-runtime, trillian, promxy-fips, velero-fips, kubernetes-dashboard-api, wave-fips, fuse-overlayfs-snapshotter, ytt, kubo-fips, crossplane-provider-azure-sql, cilium-fips, nri-mysql,...

CVE-2023-27483

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory panic vulnerability has been discovered in affected versions. Applications that use the Paved type's SetValue method with user provided input without proper...

CVE-2023-27484

crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions an already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patch's ToFieldPath, which could lead to...

CVE-2023-38495

Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, kyverno-policy-reporter-kyverno-plugin, nfs-subdir-external-provisioner, delve, actions-runner-controller, flannel-cni-plugin, gcsfuse, kubernetes-csi-livenessprobe, kubernetes-event-exporter, aws-load-balancer-controller, nri-mysql, pulumi, wazero,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, kyverno-policy-reporter-kyverno-plugin, nfs-subdir-external-provisioner, delve, actions-runner-controller, flannel-cni-plugin, gcsfuse, kubernetes-csi-livenessprobe, kubernetes-event-exporter, aws-load-balancer-controller, nri-mysql, pulumi, wazero,...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: spire-server, kubernetes-csi-livenessprobe, sftpgo-plugin-eventsearch, vault-benchmark, aws-load-balancer-controller, vault-k8s, kapp, kube-metrics-adapter, nats, overmind, bom, trust-manager, kustomize, pdfcpu, flannel, harbor-registry, trillian,...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: buildah, gitleaks, spire-server, nfs-subdir-external-provisioner, wolfictl, gitsign, actions-runner-controller, zarf, gcsfuse, kubernetes-event-exporter, sftpgo-plugin-eventsearch, fluent-bit-plugin-loki, rclone, crossplane-provider-family-aws, step-ca, oauth2-proxy,...

GO-2024-3219 github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses...

github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the net/netip package, but the version of golang libraries, runtime, and build tools...

GHSA-7H65-4P22-39J6 vulnerabilities

Vulnerabilities for packages: crossplane...

GHSA-7H65-4P22-39J6 vulnerabilities

Vulnerabilities for packages: crossplane...

GHSA-7H65-4P22-39J6 github.com/crossplane/crossplane: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A critical vulnerability was reported in the versions of golang that Crossplane depends on. Details of the golang vulnerability are included below. Crossplane does not directly use the vulnerable functions from the net/netip package, but the version of golang libraries, runtime, and build tools...

GO-2023-1980 Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane

Possible image tampering from missing image validation for Packages in github.com/crossplane/crossplane...

GO-2023-1979 Denial of service from large image in github.com/crossplane/crossplane

Denial of service from large image in github.com/crossplane/crossplane...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, terraform-provider-azurerm, protoc-gen-go, fluent-operator, dataplaneapi-fips, trillian, velero-fips, wave-fips, fuse-overlayfs-snapshotter, ytt, prometheus-alertmanager, crane, litestream, cilium-fips, nri-mysql, azure-aad-pod-identity-mic...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns, petname, gomplate, cortex-fips, ferretdb, prometheus-stackdriver-exporter, pulumi-language-yaml, terraform-docs, chartmuseum, prometheus-statsd-exporter-fips, cadvisor-fips, rekor, jsonnet-bundler, kwok, multus-cni, trillian,...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: kaniko, buf, cadvisor-fips, cilium-cli, trivy, aactl, ko, crossplane, kubescape, cadvisor, syft, ctop, dagger, kargo, melange, spire-server, spire-server-fips, prometheus, buildkitd, conftest-fips, conftest, docker-compose, grype, zot, wolfictl, loki, up, tkn...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: envoy-ratelimit, kyverno-policy-reporter-kyverno-plugin, nfs-subdir-external-provisioner, spire-server, gitsign, actions-runner-controller, zarf, gcsfuse, kubernetes-csi-livenessprobe, kubernetes-event-exporter, step-ca, rclone, crossplane-provider-family-aws,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: terraform-provider-azurerm, crossplane-provider-aws-sns, crossplane-provider-aws-cloudwatchlogs, trillian, temporal-server, fuse-overlayfs-snapshotter, prometheus-alertmanager, crossplane-provider-azure-sql, guac, azure-aad-pod-identity-mic, prometheus-operator-fips,...