AZL-39235 CVE-2023-45288 affecting package kubernetes for versions less than 1.28.4-7

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2024-25699

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could allow a remote, authenticated attacker...

CVE-2024-25699 Portal for ArcGIS has an invalid authentication vulnerability

There is a difficult‑to‑exploit improper authentication issue in the Home application for Esri Portal for ArcGIS versions 11.2 and below on Windows and Linux, and ArcGIS Enterprise versions 11.1 and below on Kubernetes, which under unique circumstances could allow a remote, authenticated attacker...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.8.6 security and bug fix updates

Red Hat Advanced Cluster Management for Kubernetes 2.8.6 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.14.19 security update

Red Hat build of MicroShift release 4.14.19 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat build of MicroShift 4.14. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.19 security update

Red Hat OpenShift Container Platform release 4.14.19 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

BIT-ARGO-CD-2024-29893 Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out o...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.54 packages and security update

Red Hat OpenShift Container Platform release 4.12.54 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.54 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.54 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

The vulnerability of the Application Summary component of the GitOps continuous delivery tool for Kubernetes Argo CD allows attackers to perform XSS attacks.

The vulnerability of the Application Summary component of the GitOps continuous delivery tool for Kubernetes Argo CD exists because measures to protect the website structure have not been taken. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using a specially...

Important: Red Hat Security Advisory: Red Hat build of MicroShift 4.15.6 security update

Red Hat build of MicroShift release 4.15.6 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat build of MicroShift 4.15.6. Red Hat Product Security has rated this update as having a security impact of Important. A Common...

Exploit for Embedded Malicious Code in Tukaani Xz

xzk8s !Docker Pulls xzk8shttps://img.shields.io/docker/pul...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.6 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.6 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

Exploit for Server-Side Request Forgery in Kubernetes Apiserver

CVE-2022-3172 demo Run poc.sh create...

Security Bulletin: Netcool Operations Insights 1.6.12 addresses multiple security vulnerabilities.

Summary Netcool Operations Insight v1.6.12 addresses multiple security vulnerabilities, listed in the CVEs below. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2022-25883 DESCRIPTION: Node.js semver package is vulnerable to a denial of...

olcne security update

1.8.1-2 - Cleanup spec file 1.8.1-1 - Fix OLM upgrade failure - upgrade from 0.17.0 to 0.23.1 failed due to a couple of crds missing - Add hostpathRequiresPrivilged value to rook template cr to be passed to module operator - Fixed Istio-1.18 and Istio-1.19 installation on aarch64 architecture -...

The vulnerability of the `loadRepoIndex()` function in the declarative tool for continuous delivery of GitOps for Kubernetes Argo CD allows a malicious actor to trigger a service failure.

The vulnerability of the loadRepoIndex function in the declarative tool for continuous delivery of GitOps for Kubernetes Argo CD is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

olcne security update

1.8.1-2 - Cleanup spec file 1.8.1-1 - Fix OLM upgrade failure - upgrade from 0.17.0 to 0.23.1 failed due to a couple of crds missing - Add hostpathRequiresPrivilged value to rook template cr to be passed to module operator - Fixed Istio-1.18 and Istio-1.19 installation on aarch64 architecture -...

The vulnerability of Helm’s diagram repository for deploying DataHub in a Kubernetes cluster relates to the use of the default cryptographic key. This allows attackers to generate a personal access token with a secret key by default.

The vulnerability of Helm’s diagram repository for deploying DataHub in a Kubernetes cluster is related to the use of the default cryptographic key. Exploiting this vulnerability could allow a malicious actor to generate a personal access token with the default secret key...

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus if the output of the command is large it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

...