AZL-42904 CVE-2024-6104 affecting package keda for versions less than 2.14.0-2

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

AZL-42637 CVE-2024-35255 affecting package keda for versions less than 2.14.1-1

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: fulcio, tkn, rekor, restic, opentelemetry-collector-contrib, terragrunt, guac, cosign, pulumi, up, spire-server, bank-vaults, py3-cassandra-medusa, timestamp-authority, py3-azure-identity, argo-events, rclone, grafana-mimir, flyte, flux-image-reflector-controller,...

Low: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-394 Security Update

Custom Metrics Autoscaler Operator for Red Hat OpenShift including security updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...

CVE-2024-24786 affecting package keda for versions less than 2.14.0-1

CVE-2024-24786 affecting package keda for versions less than 2.14.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-21698 affecting package keda for versions less than 2.14.0-1

CVE-2022-21698 affecting package keda for versions less than 2.14.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-44716 affecting package keda for versions less than 2.14.0-1

CVE-2021-44716 affecting package keda for versions less than 2.14.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-28180 affecting package keda for versions less than 2.14.0-1

CVE-2024-28180 affecting package keda for versions less than 2.14.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-3162 affecting package keda for versions less than 2.14.0-1

CVE-2022-3162 affecting package keda for versions less than 2.14.0-1. An upgraded version of the package is available that resolves this issue...

Moderate: Red Hat Security Advisory: Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-376 Bug Fixes

Custom Metrics Autoscaler Operator for Red Hat OpenShift including security updates. The following updates for the Custom Metric Autoscaler operator for Red Hat OpenShift are now available: custom-metrics-autoscaler-adapter-container custom-metrics-autoscaler-admission-webhooks-container...

CVE-2023-44487 affecting package keda for versions less than 2.4.0-14

CVE-2023-44487 affecting package keda for versions less than 2.4.0-14. A patched version of the package is available...

AZL-35843 CVE-2024-28180 affecting package keda for versions less than 2.4.0-26

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: fulcio, tkn, kubernetes-dashboard, dex, rekor, temporal-ui-server, wolfictl, weaviate, terragrunt, guac, temporal, cosign, spire-server, ko, bank-vaults, timestamp-authority, gitsign, caddy, k3s, rabbitmq-messaging-topology-operator, dgraph, flux-kustomize-controller...

AZL-35882 CVE-2024-28180 affecting package keda for versions less than 2.14.0-1

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: ko-fips, temporal, flux-kustomize-controller, gomplate, kubernetes-dashboard, frp, sigstore-scaffolding, timestamp-authority, zot, argo-workflows, grpc-health-probe, terragrunt, minio, melange, kots, rook, vault, wolfictl, temporal-fips, fulcio-fips, step, neuvector,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: fulcio, tkn, kubernetes-dashboard, dex, rekor, temporal-ui-server, wolfictl, weaviate, terragrunt, guac, temporal, cosign, spire-server, ko, bank-vaults, timestamp-authority, gitsign, caddy, k3s, rabbitmq-messaging-topology-operator, dgraph, flux-kustomize-controller...

CVE-2024-28110 vulnerabilities

Vulnerabilities for packages: falcosidekick, guac, falcosidekick-fips...

GHSA-5PF6-2QWX-PXM2 vulnerabilities

Vulnerabilities for packages: falcosidekick, guac...

GHSA-5PF6-2QWX-PXM2 vulnerabilities

Vulnerabilities for packages: falcosidekick, guac, falcosidekick-fips...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: step, trillian-fips, falcosidekick-fips, amass, caddy, argo-workflows, step-ca, trillian, k3s, wavefront-collector-for-kubernetes, ferretdb, spicedb, src, kots, caddy-fips, temporal-server-fips, temporal-server, argo-workflows-fips, kine, kube-bench-fips, kube-bench...