240 matches found
Knative Serving Resource Consumption DoS
The vulnerability of the Knative Serving deployment and application management tool is related to an uncontrolled resource consumption when processing endpoints in the /metrics directory. Exploiting this vulnerability could allow a malicious actor to cause service failures...
CVE-2023-48713
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
Design/Logic Flaw
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713
Knative Serving (on Kubernetes) contains a DoS flaw (CVE-2023-48713) caused by an unbound memory allocation in the /metrics response. If an attacker controls a pod sufficiently to influence its responses, they can trigger a denial of service in the autoscaler. The issue is specific to the metrics...
CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713: Uncontrolled Resource Consumption
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
Knative Serving Security Vulnerability
Knative Serving is a Kubernetes-based build from Knative that supports the deployment and servicing of applications and features as serverless containers. A security vulnerability exists in Knative Serving that stems from a memory allocation error, which could lead to a denial of service by an...
GHSA-QMVJ-4QR9-V547 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Summary A vulnerability was fond in Knative Serving that could allow an attacker to crash the Knative Serving autoscaler resulting in a denial of service. The attacker would need to have compromised one pod in the Knative Serving deployment, and with that position they could launch the attack...
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Summary A vulnerability was fond in Knative Serving that could allow an attacker to crash the Knative Serving autoscaler resulting in a denial of service. The attacker would need to have compromised one pod in the Knative Serving deployment, and with that position they could launch the attack...
knative:FuzzDurableConnection: Segv on unknown address with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=4783742681219072 Project: knative Fuzzing Engine: libFuzzer Fuzz Target: FuzzDurableConnection Job Type: libfuzzerasanknative Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash...
knative:FuzzDurableConnection: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=4856490675798016 Project: knative Fuzzing Engine: libFuzzer Fuzz Target: FuzzDurableConnection Job Type: libfuzzerasanknative Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c000065738 Crash State: NULL Sanitizer: address ASAN...
knative:FuzzChildName: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=6476498750275584 Project: knative Fuzzing Engine: libFuzzer Fuzz Target: FuzzChildName Job Type: libfuzzerasanknative Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreat...
knative:FuzzMessagingRoundTripTypesToJSON: Null-dereference READ with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5871730403180544 Project: knative Fuzzing Engine: libFuzzer Fuzz Target: FuzzMessagingRoundTripTypesToJSON Job Type: libfuzzerasanknative Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL...
Information Disclosure
github.com/knative/func is vulnerable to information disclosure. The vulnerability is due to compromised third-party buildpacks which expose their registry credentials or local docker socket to a malicious lifecycle container, which allows remote attackers to access unauthorized information. This...
CVE-2022-41939 Credential exposure when running third-party builders in knative/func
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...
CVE-2022-41939 Credential exposure when running third-party builders in knative/func
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious lifecycle container. This issues has bee...
PT-2022-26170 · Unknown · Knative.Dev/Func
Name of the Vulnerable Software and Affected Versions: knative.dev/func versions prior to 1.8.1 Description: The issue affects developers using malicious or compromised third-party buildpacks, potentially exposing their registry credentials or local docker socket to a malicious lifecycle containe...