GHSA-VJG6-93FV-QV64 vulnerabilities

Vulnerabilities for packages: etcd-fips, juicefs, dgraph, etcd...

GHSA-VJG6-93FV-QV64 vulnerabilities

Vulnerabilities for packages: dgraph, juicefs...

GHSA-PM3M-32R3-7MFH vulnerabilities

Vulnerabilities for packages: etcd-fips, dgraph, etcd...

GHSA-PM3M-32R3-7MFH vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-J86V-2VJR-FG8F vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-WR2V-9RPQ-C35Q vulnerabilities

Vulnerabilities for packages: dgraph...

GHSA-WR2V-9RPQ-C35Q vulnerabilities

Vulnerabilities for packages: etcd-fips, dgraph, etcd...

GHSA-2XHQ-GV6C-P224 vulnerabilities

Vulnerabilities for packages: etcd-fips, dgraph, etcd...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: metrics-server-fips, buildkitd, kubeflow, conftest-fips, kubevela, spark-operator, src, kubernetes-csi-livenessprobe, dgraph, k3d, timestamp-authority-fips, terraform-provider-sendgrid-fips, terraform-provider-sendgrid, slsa-verifier, falcoctl-fips, kube-oidc-proxy,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubevela, k3d, cortex, scorecard, aactl, src, buildkitd, slsa-verifier, kubeflow, dgraph, kubescape, up, terraform-provider-sendgrid, spark-operator...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: metrics-server-fips, helm, flux-helm-controller, prometheus-pushgateway, pulumi-kubernetes-operator, kind, prometheus-pushgateway-fips, atlantis-fips, prometheus-elasticsearch-exporter, k3d, terraform-provider-sendgrid-fips, terraform-provider-sendgrid,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, kubescape, nginx-stable, bom, kubevela, nginx-mainline, cosign, stakater-reloader, kind, pulumi-language-yaml, src, pulumi, gobuster, flux-notification-controller, spark-operator, cortex, prometheus-adapter, metacontroller, minio,...

Information Disclosure

github.com/dgraph-io/dgraph is vulnerable to Information Disclosure. The vulnerability is due to a nonce collision which makes the audit logs susceptible to brute force attacks. The last 4 bytes of the nonce are determined from the length of the log line, which makes decrypting the log through...

CVE-2023-31135

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

Design/Logic Flaw

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

Dgraph Audit Log Encryption Vulnerability

Impact Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph v23.0.0 are affected. Patches This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0. Workaround...

GHSA-92WQ-Q9PQ-GW47 Dgraph Audit Log Encryption Vulnerability

Impact Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. All audit logs generated by versions of Dgraph v23.0.0 are affected. Patches This issue was patched in https://github.com/dgraph-io/dgraph/pull/8323. Dgraph users should upgrade to v23.0.0. Workaround...

CVE-2023-31135 Dgraph Audit Log Encryption nonce reuse

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

CVE-2023-31135 Dgraph Audit Log Encryption nonce reuse

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

CVE-2023-31135

CVE-2023-31135 affects Dgraph audit logs due to nonce collisions in the log encryption scheme. The first 12 bytes come from a baseIv, and the last 4 bytes from the log line length; because log lines often share the same length, nonces are reused. All audit logs generated by versions