Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.58 CNF vRAN extras security update

An update for ztp-site-generate-container, topology-aware-lifecycle-manager and bare-metal-event-relay is now available for Red Hat OpenShift Container Platform 4.12. This release includes a security update for CVE-2023-30841 topology-aware-lifecycle-manager-operator-container: baremetal-operator...

Alternate Repository for Veeam Kasten for Kubernetes Container Images

Solution This article documents an alternate location where Kasten's images are stored. Kasten's container images are hosted on the Google Container Registry gcr.io/kasten-images; however, this location may be inaccessible due to country-specific or company-imposed firewalls. If allowing access t...

ALSA-2024:3826 Moderate: podman security and bug fix update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: jose-go: improper handling of highly compressed data CVE-2024-28180 podman: golan...

Moderate: podman security and bug fix update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: jose-go: improper handling of highly compressed data CVE-2024-28180 podman: golan...

How to Configure AWS Application Loadbalancer (ALB) for Veeam Kasten for Kubernetes

Purpose This article provides an example of configuring AWS Application Loadbalancer ALB for accessing the Veeam Kasten for Kubernetes UI. Note: This documentation assumes that the ALB ingress controller has already been installed and configured. Solution What is an ALB An Application Load Balanc...

How to Enable Veeam Kasten for Kubernetes Disaster Recovery using CLI

Purpose This article provides step-by-step instructions on how to enable Veeam Kasten for Kubernetes Disaster Recovery KDR using CLI. Veeam Kasten for Kubernetes Documentation - Disaster Recovery Solution 1. Replace in the following command and run it to create a DR secret with a passphrase: Note...

GO-2024-2768 Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources in github.com/rancher/rancher

Rancher does not properly specify ApiGroup when creating Kubernetes RBAC resources in github.com/rancher/rancher. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2024-2753 Denial of service in Kubernetes in k8s.io/kubernetes

Denial of service in Kubernetes in k8s.io/kubernetes...

GO-2024-2780 Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes

Kubelet Incorrect Privilege Assignment in k8s.io/kubernetes...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.28 bug fix and security update

Red Hat OpenShift Container Platform release 4.14.28 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

Authentication Bypass By Spoofing

github.com/kubernetes/kubernetes/ is vulnerable to Authentication Bypass By Spoofing. The vulnerability is due to improper issuers check which allows an attacker to bypass the issue "iss" check during JSON Web Token JWT authentication...

How to Enable Changed Block Tracking for Guest Cluster on vSphere with Tanzu

Purpose Changed Block Tracking is a VMware feature that tracks changes in virtual disks. Veeam Kasten for Kubernetes uses this feature in vSphere with Tanzu Guest Clusters to efficiently back up Persistent Volumes. Enabling Changed Block Tracking in each Supervisor Cluster where Veeam Kasten for...

BIT-ARGO-CD-2024-36106 Argo CD allows authenticated users to enumerate clusters by name

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It’s possible for authenticated users to enumerate clusters by name by inspecting error messages. It’s also possible to enumerate the names of projects with project-scoped clusters if you know the names of the clusters. Thi...

BIT-ARGO-CD-2024-37152 Unauthenticated Access to sensitive settings in Argo CD

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in...

The vulnerability of the kruise-daemon component in the Kubernetes Kruise automation application allows a malicious individual to gain unauthorized access to protected information and increase their privileges.

The vulnerability of the kruise-daemon component in the Kubernetes application automation tool involves deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information and increase their privileges...

What Data Does Veeam Kasten for Kubernetes Include in the Phone Home Reports

Purpose This article documents what data is included in the phone home reports sent by Veeam Kasten for Kubernetes. Solution The data is divided into the following sections Basic Data Infrastructure Data Run Time Data for Billing Purposes Additional Metrics Profiles Artifact Metrics Basic Data...

How to Properly Off-Board a Namespace From Veeam Kasten for Kubernetes Backups

Purpose This article documents the procedure to properly off-board a namespace in Veeam Kasten for Kubernetes. Solution 1. Check all restorepointcontents for the policy using the following command: Replace with the actual policy name. kubectl get restorepointcontents -l k10.kasten.io/policyName=...

Troubleshooting '401 - Unauthorized' or 'x509' Errors When Accessing the Veeam Kasten for Kubernetes Dashboard

Challenge When attempting to access the Veeam Kasten for Kubernetes dashboard the following error occurs despite using the cacertconfigmap.name helm value: 401 - Unauthorized This issue may also manifest as errors related to x509 in the gateway pod or auth-svc pod logs: x509: certificate signed b...

CVE-2024-37152 Unauthenticated Access to sensitive settings in Argo CD

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. The vulnerability allows unauthorized access to the sensitive settings exposed by /api/v1/settings endpoint without authentication. All sensitive settings are hidden except passwordPattern. This vulnerability is fixed in...

CVE-2024-37152

Argo CD exposes sensitive settings via /api/v1/settings without authentication, enabling unauthenticated access to items such as passwordPattern. The issue is fixed in versions 2.11.3, 2.10.12, and 2.9.17. Affected product: Argo CD (Kubernetes GitOps tool). Root cause described across sources as ...