[SECURITY] Fedora 34 Update: golang-github-xordataexchange-crypt-0.0.2-11.20190412gitb2862e3.fc34

Store and retrieve encrypted configs from etcd or consul...

[SECURITY] Fedora 35 Update: golang-github-xordataexchange-crypt-0.0.2-11.20190412gitb2862e3.fc35

Store and retrieve encrypted configs from etcd or consul...

Apache Apisix Information Disclosure Vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd and features dynamic routing and plugin hot-loading for API management in microservices systems. versions prior to Apache Apisix 2.13.1 contain an information...

GHSA-H6XX-PMXH-3WGP go.etcd.io/etcd Authentication Bypass

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

go.etcd.io/etcd Authentication Bypass

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remot...

Improper Authentication

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 is vulnerable to an improper authentication issue when role-based access control RBAC is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name CN which matches a valid RBAC username, a remote...

CVE-2020-15106 affecting package etcd for versions less than 3.5.0-3

CVE-2020-15106 affecting package etcd for versions less than 3.5.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2020-15136 affecting package etcd for versions less than 3.5.0-3

CVE-2020-15136 affecting package etcd for versions less than 3.5.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2020-15112 affecting package etcd for versions less than 3.5.0-3

CVE-2020-15112 affecting package etcd for versions less than 3.5.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2020-15114 affecting package etcd for versions less than 3.5.0-3

CVE-2020-15114 affecting package etcd for versions less than 3.5.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2020-15113 affecting package etcd for versions less than 3.5.0-3

CVE-2020-15113 affecting package etcd for versions less than 3.5.0-3. An upgraded version of the package is available that resolves this issue...

CVE-2020-15115 affecting package etcd for versions less than 3.5.0-3

CVE-2020-15115 affecting package etcd for versions less than 3.5.0-3. An upgraded version of the package is available that resolves this issue...

Apache Apisix Input Validation Error Vulnerability

Apache Apisix is a cloud-native microservices API gateway service from the Apache Foundation. The software is based on OpenResty and etcd, with dynamic routing and plugin hot-loading for API management in microservices systems. An attacker could use this vulnerability to bypass the bodyschema...

GHSA-5GJM-FJ42-X983 etcd Cross-site Request Forgery (CSRF)

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe can't PUT from an HTML form or such but POST allows creating...

GHSA-JP32-VMM6-3VF5 Directory Traversal in Kubernetes

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd...

etcd Cross-site Request Forgery (CSRF)

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe can't PUT from an HTML form or such but POST allows creating...

DNS Rebinding in etcd

DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost or any other address...

GO-2022-0701 Directory traversal in k8s.io/kubernetes

Crafted object type names can cause directory traversal in Kubernetes. Object names are not validated before being passed to etcd. This allows attackers to write arbitrary files via a crafted object name, hence causing directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift...

Directory Traversal in Kubernetes

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd...

GHSA-WF43-55JJ-VWQ8 DNS Rebinding in etcd

DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost or any other address...