CVE-2024-51744 vulnerabilities

Vulnerabilities for packages: kubernetes, temporal-server, terraform-provider-azurerm, chartmuseum, tekton-chains, temporal, scorecard, wal-g, weaviate, boring-registry, actions-runner-controller, doppler-kubernetes-operator, vexctl, kubeflow-katib, goreleaser, falcoctl, tkn,...

CVE-2024-34155 vulnerabilities

Vulnerabilities for packages: conftest-fips, vertical-pod-autoscaler, kube-bench, dynamic-localpv-provisioner, rabbitmq-messaging-topology-operator-fips, terraform-provider-aws, prometheus-postgres-exporter-fips, kube-vip-fips, newrelic-nri-statsd, grafana-operator, kubeflow-pipelines,...

AZL-48327 CVE-2024-43806 affecting package flux for versions less than 0.194.5-4

Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using rustix::fs::Dir using the linuxraw backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::readmore, this can cause quick and...

GO-2022-0960 Flux CLI Workload Injection in github.com/fluxcd/flux2

Flux CLI Workload Injection in github.com/fluxcd/flux2...

GHSA-V23V-6JW2-98FQ vulnerabilities

Vulnerabilities for packages: argo-workflows, neuvector-scanner, guac, dagdotdev, helm-push, docker-credential-gcr, rancher-fleet, zot, vault, k9s, tekton-chains, harbor-scanner-trivy-fips, helm-fips, buildkitd, kubescape, cadvisor, opentelemetry-collector-fips, falcoctl, eksctl, istio-pilot-agen...

Malicious code in rippling-flux-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rippling-flux-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2963 Malicious code in rippling-flux-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2964 Malicious code in rippling-flux-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rippling-flux-dev (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2962 Malicious code in rippling-flux-dev (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in flux_dev_tools.server.flask (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2384 Malicious code in flux_dev_tools (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: tekton-chains, wal-g, sigstore-scaffolding, sops, boring-registry, timestamp-authority, external-dns, py3-cassandra-medusa, up, harbor-registry, goreleaser, falcoctl, tkn, rekor, nuclei, step-ca, flux-kustomize-controller, rclone, flux-source-controller,...

GHSA-V554-XWGW-HC3W source-controller leaks Azure Storage SAS token into logs

Impact When source-controller is configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access t...

Source controller 安全漏洞

Source controller is a component of the Flux project. A security vulnerability exists in source-controller versions prior to 1.2.5. An attacker can exploit this vulnerability to gain access to Azure Blob Storage...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: conftest-fips, spicedb, sonobuoy, vertical-pod-autoscaler, neuvector-scanner, mc-fips, tigera-operator, kube-bench, dynamic-localpv-provisioner, guac, docker-credential-acr-env, helm-push, prometheus-postgres-exporter-fips, prometheus-bind-exporter,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: argo-workflows, minio, temporal-ui-server-fips, guac, flux-kustomize-controller, zot, vault, tekton-chains, kubescape, temporal-ui-server, cilium, falcoctl, frp, skopeo, kubernetes-dashboard-fips, temporal-fips, weaviate, bank-vaults, dex, sops, step,...

BIT-KUSTOMIZE-2021-41254 Privilege escalation to cluster admin on multi-tenant environments

kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could...

BIT-KUSTOMIZE-2022-24877 Improper path handling in kustomization files allows path traversal

Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments...