CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: buildkitd, docker-credential-gcr, flux-helm-controller, kubeflow-katib, skaffold, falcoctl-fips, ctop, kots, eksctl, k3d, slsa-verifier, skopeo, falcoctl, kubevela, helm-fips, flux-image-reflector-controller, helm-operator, loki, cri-tools,...

CVE-2023-44487 affecting package helm for versions less than 3.14.0-1

CVE-2023-44487 affecting package helm for versions less than 3.14.0-1. An upgraded version of the package is available that resolves this issue...

GHSA-7WW5-4WQC-M92C vulnerabilities

Vulnerabilities for packages: buildkitd, flux-helm-controller, kots, ctop, eksctl, k3d, helm-push, melange, flux-source-controller, kubevela, grype, newrelic-infrastructure-agent, trivy, k8sgpt, kubescape, helm, up, cilium-cli, zot, kaniko, gitness, fuse-overlayfs-snapshotter, skaffold...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

GHSA-45X7-PX36-X8W8 vulnerabilities

Vulnerabilities for packages: buildkitd, kubeflow-katib, sops, eksctl, crossplane-provider-azure-sql, mongo-tools, terraform-provider-aws, prometheus-pushgateway, dockerize-fips, flux-source-controller, boring-registry, hugo, flux-image-reflector-controller, grype, ko-fips,...

CVE-2023-2253 affecting package helm for versions less than 3.13.2-1

CVE-2023-2253 affecting package helm for versions less than 3.13.2-1. An upgraded version of the package is available that resolves this issue...

olcne security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build 2.1.3.3 - Add OL9 support 2.1.3.2 - Update inline with Linux team building conmon for all but OL7. cri-o...

CVE-2023-47640

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

Default credentials

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: buildkitd, slsa-verifier, falcoctl-fips, k3d, vault-csi-provider, prometheus-adapter-fips, kubernetes-csi-livenessprobe-fips, spark-operator, bank-vaults-fips, kubevela, prometheus-stackdriver-exporter, cortex, kubernetes-csi-livenessprobe, plutono-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: dgraph, aactl, cortex, kubescape, scorecard, kubevela, k3d, kubeflow, buildkitd, slsa-verifier, terraform-provider-sendgrid, spark-operator, src, up...

SUSE: Security Advisory (SUSE-SU-2023:4124-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2023:4124-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4124-1 advisory. helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action...

SUSE-SU-2023:4124-1 Security update for helm

This update for helm fixes the following issues: helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action FIX Default ServiceAccount yaml fixregistry: unswallow error remove useless print during prepareUpgrade fixregistry:...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: buildkitd, kubeflow-katib, cue, prometheus-pushgateway, minio, hugo, flux-source-controller, kind, flux-image-reflector-controller, newrelic-infrastructure-agent, flux-image-automation-controller, kubernetes-dashboard, node-problem-detector,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: buildkitd, kubeflow-katib, cue, prometheus-pushgateway, minio, hugo, flux-source-controller, kind, flux-image-reflector-controller, newrelic-infrastructure-agent, flux-image-automation-controller, kubernetes-dashboard, node-problem-detector,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: buildkitd, kubeflow-katib, cue, terraform-provider-aws, minio, hugo, flux-source-controller, kind, grype, newrelic-infrastructure-agent, node-problem-detector, dgraph, gomplate, terraform-provider-sendgrid-fips, git-lfs, helm, src, kubeflow, kubeflow-fips, mc, hey,...