CVE-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default...

CVE-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default...

CVE-2024-7646

A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects in the networking.k8s.io or extensions API group can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.15.27 security update

Red Hat OpenShift Container Platform release 4.15.27 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2024:1166-2)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1166-2 advisory. - Upgrade from v1.26.9 to v1.26.14 - CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. bsc1219964 Tenable has extracted the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.7 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.7 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

SUSE-SU-2024:1166-2 Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: - Upgrade from v1.26.9 to v1.26.14 - CVE-2024-0793: Fixed a DoS caused via a malformed HPA v1 manifest. bsc1219964...

GHSA-6R4J-4RJC-8VW5 RBAC Roles for `etcd` created by Kamaji are not disjunct

Summary Using an "open at the top" range definition in RBAC for etcd roles leads to some TCPs API servers being able to read, write and delete the data of other control planes. Details The problematic code is this:...

CVE-2024-42480

Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed i...

CVE-2024-42480 Kamaji's RBAC Roles for `etcd` are not disjunct

Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed i...

CVE-2024-42480 Kamaji's RBAC Roles for `etcd` are not disjunct

Kamaji is the Hosted Control Plane Manager for Kubernetes. In versions 1.0.0 and earlier, Kamaji uses an "open at the top" range definition in RBAC for etcd roles leading to some TCPs API servers being able to read, write, and delete the data of other control planes. This vulnerability is fixed i...

CVE-2024-42480

CVE-2024-42480 describes a vulnerability in Kamaji (Hosted Control Plane Manager for Kubernetes) where versions 1.0.0 and earlier use an "open at the top" range definition in RBAC for etcd roles. This misconfiguration allows certain TCP API servers to read, write, and delete data belonging to oth...

Git-Syncing into Trouble: Exploring Command Injection Flaws in Kubernetes

...

Git-Syncing into Trouble: Exploring Command Injection Flaws in Kubernetes

...

Security Bulletin: IBM Cloud Pak for Data is vulnerable due to k8s.io/kubernetes ( CVE-2023-2728, CVE-2023-2727, CVE-2023-5408, CVE-2023-3955, CVE-2023-3676 )

Summary k8s.io/kubernetes is used by IBM Cloud Pak for Data as part of the platform. CVE-2023-2728, CVE-2023-2727, CVE-2023-5408, CVE-2023-3955, CVE-2023-3676. Vulnerability Details CVEID:CVE-2023-2728 DESCRIPTION: Kubernetes could allow a remote authenticated attacker to bypass security...

SUSE-SU-2024:2859-1 Security update for kubernetes1.24

This update for kubernetes1.24 fixes the following issues: - CVE-2021-25743: Fixed sanitization of raw data of escape, meta or control sequences before output it to terminal bsc1194400...

SUSE-SU-2024:2858-1 Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: - CVE-2021-25743: Fixed sanitization of raw data of escape, meta or control sequences before output it to terminal bsc1194400...

Network restriction bypass via race condition during namespace termination

CVSS Rating: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Low 3.1 A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.34 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.34 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.15.25 packages and security update

Red Hat OpenShift Container Platform release 4.15.25 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...