PT-2022-16050 · Helm +2 · Helm +2

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 3.10.3 Description: Helm is a tool for managing Charts, pre-configured Kubernetes resources. The issue results in Uncontrolled Resource Consumption, leading to Denial of Service. Input to functions in the strvals packag...

Security fix for the ALT Linux 10 package helm version 3.10.2-alt1

3.10.2-alt1 built Dec. 8, 2022 Mikhail Gordeev in task 311367 Dec. 3, 2022 Mikhail Gordeev - new version 3.10.2 - Fixes: CVE-2022-36055 CVE-2022-36049 CVE-2021-32690 CVE-2021-21303...

GHSA-2QJP-425J-52J9 vulnerabilities

Vulnerabilities for packages: ctop...

CVE-2022-23471 vulnerabilities

Vulnerabilities for packages: ctop...

GO-2022-1113 Server-side request forgery in github.com/oam-dev/kubevela

When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse® on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. Vulnerability Details CVEID:CVE-2016-1000023 DESCRIPTION: Minimatch is vulnerable to a denial of service, caused...

kubernetes security update

kubernetes 1.22.16-1 - Added Oracle specific build files for Kubernetes - Add preBuildOL8Commands to Jenkinsfile kubernetes 1.23.14-1 - Added Oracle specific build files for Kubernetes kubernetes 1.24.8-1 - Added Oracle specific build files for Kubernetes olcne 1.5.8-4 - Fix 1.21 kubernetes versi...

KubeVela VelaUX APIserver has SSRF vulnerability

Impact Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. This issue is patched in 1.5.9 and 1.6.2. References Fix by: 50...

Server side request forgery (ssrf)

KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability. Users who're...

CVE-2022-36055 affecting package helm for versions less than 3.9.4-2

CVE-2022-36055 affecting package helm for versions less than 3.9.4-2. An upgraded version of the package is available that resolves this issue...

CVE-2022-36049 affecting package helm for versions less than 3.9.4-2

CVE-2022-36049 affecting package helm for versions less than 3.9.4-2. An upgraded version of the package is available that resolves this issue...

PT-2022-24943 · Kubevela · Kubevela

Name of the Vulnerable Software and Affected Versions: KubeVela versions 1.5 through 1.5.7 KubeVela versions 1.6 through 1.6.0 Description: KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this issue. When using Helm Chart as the...

SUSE: Security Advisory (SUSE-SU-2022:3666-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2022:3666-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3666-1 advisory. helm was updated to version 3.9.4: CVE-2022-36055: Fixed denial of service through string value...

SUSE-SU-2022:3666-1 Security update for helm

This update for helm fixes the following issues: helm was updated to version 3.9.4: CVE-2022-36055: Fixed denial of service through string value parsing bsc1203054. Updating the certificates used for testing Updating index handling helm was updated to version 3.9.3: - CVE-2022-1996: Updated...

GO-2022-1040 Insufficient sanitization of data files in helm.sh/helm/v3

Helm does not sanitize all fields read from repository data files. A maliciously crafted data file may contain strings containing arbitrary data. If printed to a terminal, a malicious string could obscure or alter data on the screen...

Design/Logic Flaw

Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attacker has certain details of SAML IdP metadata, and configures their own SAML on the same backend, the attacker can delete all SAML...

CVE-2022-31122 Wire-server vulnerable to Token Recipient Confusion resulting in account impersonation, deletion or malicious account creation

Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Confusion. If an attacker has certain details of SAML IdP metadata, and configures their own SAML on the same backend, the attacker can delete all SAML...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5.3 security fixes and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.5.3 General Availability release images, which fix security issues and bugs, as well as update container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS...

Malicious code in harness-helm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0008cf12cac94140f089a7ba2a7d297c874737f5bfbd34256de9b47b44d084bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...