Important: Red Hat Enhancement Advisory: Red Hat Service Interconnect 1.4.7 Release rpms

This is release 1.4 of the rpms for Red Hat Service Interconnect. Red Hat Service Interconnect 1.4 introduces a service network, linking TCP and HTTP services across the hybrid cloud. A service network enables communication between services running in different network locations or sites. It allo...

CVE-2024-41666

A vulnerability was found in ArgoCD's web-based terminal. This issue may allow a user to continue sending WebSocket messages and access sensitive information even after their p, role:myrole, exec, create, /, and allow permissions are revoked. The terminal session remains active as long as it is...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.61 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.61 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

RHEL 8 / 9 : OpenShift Container Platform 4.15.23 (RHSA-2024:4702)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4702 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private clo...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.16.4 packages and security update

Red Hat OpenShift Container Platform release 4.16.4 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.16.4 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.4 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

CVE-2024-41666

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to...

CVE-2024-41666

Argo CD's Web-based terminal vulnerability allows a user with permissions p, role:myrole, exec, create, / , allow to continue operations in the container even after revoking that permission, as long as the terminal view stays open. The issue can persist beyond token expiration/revocation and is n...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

BIT-ARGO-CD-2024-40634 Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to...

External Secrets 安全漏洞

External Secrets is a Kubernetes-related application in the External Secrets open source. A security vulnerability exists in external-secrets version 0.9.16 and earlier, which stems from the presence of an insecure privilege vulnerability that allows an attacker to access sensitive data and eleva...

Photon OS 4.0: Kubernetes PHSA-2024-4.0-0598

An update of the kubernetes package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0598. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 9 : podman (RHSA-2024:4825)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4825 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods...

Photon OS 3.0: Kubernetes PHSA-2023-3.0-0631

An update of the kubernetes package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-3.0-0631. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 4.0: Kubernetes PHSA-2023-4.0-0427

An update of the kubernetes package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-4.0-0427. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

HwameiStor 安全漏洞

HwameiStor is a Kubernetes-native Container Attached Storage CAS solution open-sourced by HwameiStor. A security vulnerability exists in HwameiStor v0.14.3 and earlier versions, which stems from the presence of an insecure privilege that allows an attacker to access sensitive data and elevate...

Logging operator 安全漏洞

Logging operator is a Kubernetes logging manager in the Kube Logging open source. A security vulnerability exists in Logging operator version 4.6.0 and earlier, which stems from an insecure privilege vulnerability that allows an attacker to access sensitive data and elevate privileges by obtainin...

The vulnerability of the declarative delivery tool for GitOps in Kubernetes Argo CD allows a attacker to trigger a service failure.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted JSON payload to the final endpoint /api/webhook...