AZL-35882 CVE-2024-28180 affecting package keda for versions less than 2.14.0-1

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-35843 CVE-2024-28180 affecting package keda for versions less than 2.4.0-26

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: bank-vaults, temporal-ui-server-fips, fulcio, step, temporal-fips, gitsign, cert-manager, aactl, slsa-verifier, gomplate, rancher-agent, vexctl, flux-kustomize-controller, ko-fips, bank-vaults-fips, apko, frp, kubernetes-dashboard-fips,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: cosign, gitsign, argo-workflows, fulcio, falcoctl, grpc-health-probe, kubernetes-dashboard, apko, spire-server, temporal, guac, zarf, policy-controller, step-ca, rabbitmq-messaging-topology-operator, wolfictl, sigstore-scaffolding, zot, aactl, falco, kube-rbac-proxy,...

CVE-2024-28110 vulnerabilities

Vulnerabilities for packages: guac, falcosidekick, falcosidekick-fips, keda-fips...

GHSA-5PF6-2QWX-PXM2 vulnerabilities

Vulnerabilities for packages: guac, falcosidekick, falcosidekick-fips, keda-fips...

GHSA-5PF6-2QWX-PXM2 vulnerabilities

Vulnerabilities for packages: guac, falcosidekick...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: temporal-server, kine, trillian, amass, spicedb, wavefront-collector-for-kubernetes, step, keda-fips, trillian-fips, kots, argo-workflows-fips, ferretdb, falcosidekick-fips, argo-workflows, src, caddy-fips, k3s, caddy, kube-bench-fips, step-ca, temporal-server-fips,...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: trillian, argo-workflows, spicedb, amass, step-ca, kots, k3s, kube-bench, src, caddy, kine, step, temporal-server, ferretdb...

AZL-35660 CVE-2024-24786 affecting package keda for versions less than 2.14.0-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35579 CVE-2024-24786 affecting package keda for versions less than 2.4.0-24

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: trillian, argo-workflows, spicedb, amass, step-ca, kots, k3s, kube-bench, src, caddy, kine, step, temporal-server, ferretdb...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: temporal-server, kine, trillian, amass, spicedb, wavefront-collector-for-kubernetes, step, keda-fips, trillian-fips, kots, argo-workflows-fips, ferretdb, falcosidekick-fips, argo-workflows, src, caddy-fips, k3s, caddy, kube-bench-fips, step-ca, temporal-server-fips,...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: temporal-server, kine, trillian, amass, spicedb, wavefront-collector-for-kubernetes, step, keda-fips, trillian-fips, kots, argo-workflows-fips, ferretdb, falcosidekick-fips, argo-workflows, src, caddy-fips, k3s, caddy, kube-bench-fips, step-ca, temporal-server-fips,...

CVE-2021-44716 affecting package keda for versions less than 2.4.0-19

CVE-2021-44716 affecting package keda for versions less than 2.4.0-19. A patched version of the package is available...

GHSA-9763-4F94-GFCH vulnerabilities

Vulnerabilities for packages: rclone, crossplane-provider-aws-route53, crossplane-provider-aws-cloudformation, crossplane-provider-aws-eks, kaniko, scorecard, crossplane-provider-aws-rds, crossplane-provider-family-aws, pulumi-language-yaml, crossplane-provider-aws-kms, melange, pulumi, crossplan...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: fulcio-fips, timestamp-authority-fips, fulcio, oauth2-proxy, tkn, kots, gitsign, aactl, rekor, slsa-verifier, flux-source-controller, spire-server, sops, cosign, kubescape, argo-workflows, vexctl, falco, flux-kustomize-controller, dex, cloudflared, terragrunt,...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: kubescape, envoy-ratelimit, kubernetes-csi-external-resizer, docker-compose, cri-tools, metrics-server, volume-modifier-for-k8s, k3s, temporal, kubevela, kine, kubernetes, temporal-server, buildkitd...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, aactl, spark-operator, buildkitd, falco, prometheus-blackbox-exporter, scorecard, k3d, src, kubeflow, kubevela, up, kubescape, cortex, slsa-verifier, dgraph...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: timestamp-authority-fips, scorecard, smarter-device-manager-fips, buildkitd, volume-modifier-for-k8s-fips, spark-operator, aactl, dynamic-localpv-provisioner-fips, terraform-provider-sendgrid, slsa-verifier, dgraph, kubescape, kiam, metrics-server-fips, falco,...