GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubescape, prometheus-blackbox-exporter, dynamic-localpv-provisioner-fips, kube-oidc-proxy, slsa-verifier, buildkitd, falcoctl-fips, aactl, dgraph, metrics-server-fips, bank-vaults-fips, conftest-fips, smarter-device-manager-fips, timestamp-authority-fips,...

SUSE: Security Advisory (SUSE-SU-2023:4124-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2023:4124-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4124-1 advisory. helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action...

SUSE-SU-2023:4124-1 Security update for helm

This update for helm fixes the following issues: helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action FIX Default ServiceAccount yaml fixregistry: unswallow error remove useless print during prepareUpgrade fixregistry:...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: kubescape, aws-load-balancer-controller, prometheus-pushgateway, kube-oidc-proxy, prometheus-mysqld-exporter, falcoctl-fips, secrets-store-csi-driver-provider-gcp, prometheus-statsd-exporter-fips, zot, tkn, wavefront-collector-for-kubernetes, secrets-store-csi-driver...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: kubescape, aws-load-balancer-controller, prometheus-pushgateway, kube-oidc-proxy, prometheus-mysqld-exporter, falcoctl-fips, secrets-store-csi-driver-provider-gcp, prometheus-statsd-exporter-fips, zot, tkn, wavefront-collector-for-kubernetes, secrets-store-csi-driver...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: terraform, spark-operator, pulumi-kubernetes-operator, slsa-verifier, atlantis, scorecard, metrics-server, buildkitd, kpt, kubernetes-csi-livenessprobe, aws-efs-csi-driver, terraform-provider-azurerm, nri-prometheus, kubevela, hugo, kaf, nats, nginx-mainline, pulumi,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kubescape, nginx-mainline, conftest, kube-oidc-proxy, terraform-provider-aws, falcoctl-fips, secrets-store-csi-driver-provider-gcp, ip-masq-agent, secrets-store-csi-driver, kubeflow, kind, vault-csi-provider, mc, kubeflow-katib, prometheus-postgres-exporter, gobuster...

AZL-34799 CVE-2023-44487 affecting package helm for versions less than 3.15.2-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-33343 CVE-2023-44487 affecting package helm for versions less than 3.14.0-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

GHSA-622H-H2P8-743X JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

Impact A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. Patches Upgrade to NeuVector version 5.2.2 or later and latest Helm chart 2.6.3+....

Path Traversal

github.com/argoproj/argo-cd/v2 is vulnerable to Path Traversal. The vulnerability is caused by a missing validation check in the repo server API that prevents file traversal attacks. This can lead to an attacker leaking values or files from the referenced Helm Chart by using a using a...

CVE-2023-40026

A flaw was found in Argo CD. For any version using Helm, using a specially crafted Helm file could reference external Helm charts handled by the same repo-server to leak values or files from the referenced Helm Chart. This issue is possible because the Helm paths were predictable. Mitigation...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

CVE-2023-40026

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

CVE-2023-40026

CVE-2023-40026 describes a path traversal in Argo CD prior to version 2.3 where a specially crafted Helm file could reference external Helm charts handled by the repo-server, allowing leakage of values or files from the referenced charts due to predictable Helm paths. Exploitation requires access...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

GHSA-6JQW-JWF5-RP8H Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

CVE-2023-40026: Improper Limitation of a Pathname to a Restricted Directory

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...