BIT-HELM-2022-36055 Denial of service in Helm

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functions in the strvals package that can cause an out of memory panic. The strvals package contains a parser that turns strings in to Go...

BIT-HELM-2023-25165 getHostByName Function Information Disclosure

Helm is a tool that streamlines installing and managing Kubernetes applications.getHostByName is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS...

BIT-GITLAB-RUNNER-2020-13327

An issue has been discovered in GitLab Runner affecting all versions starting from 13.4.0 before 13.4.2, all versions starting from 13.3.0 before 13.3.7, all versions starting from 13.2.0 before 13.2.10. Insecure Runner Configuration in Kubernetes Environments...

BIT-CONTOUR-2020-15127 Denial of service in Contour

In Contour Ingress controller for Kubernetes before version 1.7.0, a bad actor can shut down all instances of Envoy, essentially killing the entire ingress data plane. GET requests to /shutdown on port 8090 of the Envoy pod initiate Envoy's shutdown procedure. The shutdown procedure includes...

BIT-CONTOUR-2021-32783 Authorization bypass in Contour

Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy...

BIT-ARGO-CD-2023-25163

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error...

BIT-ARGO-CD-2023-40029

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. pull request 7139 introduced the ability ...

BIT-ARGO-CD-2023-40584

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

BIT-ARGO-WORKFLOWS-2022-29164 Privilege Escalation in argo-workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

BIT-AIRFLOW-2023-51702 Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...

Critical: Red Hat Security Advisory: OpenShift Container Platform 4.12.51 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.51 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: syft, ferretdb, kubernetes-dashboard-metrics-scraper, crossplane-provider-aws-sqs, litefs, kargo, nats, spicedb, boring-registry, up, kubernetes-dashboard, ollama, grafana-operator, local-path-provisioner, k8ssandra-operator, configmap-reload, kubewatch,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-hostpath, logstash-exporter-fips, cass-operator, terraform-provider-azurerm, rabbitmq-messaging-topology-operator, docker-compose, prometheus-redis-exporter-fips, cosign-fips, vault-k8s-fips, kustomize, prometheus-beat-exporter,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: minio-fips, prometheus-pushgateway-fips, aws-load-balancer-controller, newrelic-infrastructure-agent, capslock, nri-mssql, esbuild, mockery, tigera-operator-fips, nfs-subdir-external-provisioner-fips, logstash-exporter-fips, cass-operator, wait-for-port,...

CVE-2023-45290 vulnerabilities

Vulnerabilities for packages: ferretdb, ytt, kubernetes-dashboard-metrics-scraper, up, litefs, sbom-scorecard, nats, kubernetes-dashboard, kind, direnv, grafana-operator, local-path-provisioner, k8ssandra-operator, configmap-reload, kubewatch, nfs-subdir-external-provisioner, slsa-verifier,...

CVE-2024-24785 vulnerabilities

Vulnerabilities for packages: minio-fips, prometheus-pushgateway-fips, aws-load-balancer-controller, newrelic-infrastructure-agent, capslock, nri-mssql, esbuild, mockery, tigera-operator-fips, nfs-subdir-external-provisioner-fips, logstash-exporter-fips, cass-operator, wait-for-port,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: minio-fips, prometheus-pushgateway-fips, aws-load-balancer-controller, newrelic-infrastructure-agent, capslock, nri-mssql, esbuild, mockery, tigera-operator-fips, nfs-subdir-external-provisioner-fips, logstash-exporter-fips, cass-operator, wait-for-port,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: minio-fips, prometheus-pushgateway-fips, aws-load-balancer-controller, newrelic-infrastructure-agent, capslock, nri-mssql, esbuild, mockery, tigera-operator-fips, nfs-subdir-external-provisioner-fips, logstash-exporter-fips, cass-operator, wait-for-port,...

AZL-35662 CVE-2024-24786 affecting package kubernetes for versions less than 1.30.1-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-24783 vulnerabilities

Vulnerabilities for packages: ferretdb, ytt, kubernetes-dashboard-metrics-scraper, up, litefs, sbom-scorecard, nats, kubernetes-dashboard, kind, direnv, grafana-operator, local-path-provisioner, k8ssandra-operator, configmap-reload, kubewatch, nfs-subdir-external-provisioner, slsa-verifier,...