GHSA-5WJ4-WFFQ-3378 Ingress nginx annotation injection causes arbitrary command execution

Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-stackdriver-exporter, dynamic-localpv-provisioner-fips, k3d, kubeflow, smarter-device-manager-fips, kube-oidc-proxy, terraform-provider-sendgrid, cortex, dgraph, terraform-provider-sendgrid-fips, prometheus-blackbox-exporter, aactl, scorecard,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: spark-operator, kubeflow, slsa-verifier, terraform-provider-sendgrid, kubevela, buildkitd, dgraph, aactl, src, up, cortex, k3d, scorecard, kubescape...

Code injection

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation...

CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation...

CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation...

CVE-2023-5044

CVE-2023-5044 : Code injection via the nginx.ingress.kubernetes.io/permanent-redirect annotation in Kubernetes ingress-nginx. The root cause is improper input validation of the permanent-redirect annotation, enabling an attacker to inject executable content. Public material confirms a PoC/exploit...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.8.3 security and bug fix updates

Red Hat Advanced Cluster Management for Kubernetes 2.8.3 General Availability release images, which provide security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a...

Important: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.1 security and bug fix update

The Migration Toolkit for Containers MTC 1.8.1 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Important: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.3.3 security updates and bug fixes

Multicluster Engine for Kubernetes 2.3.3 General Availability release images, which contain security updates and fix bugs. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.40 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.40 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.40 security and extras update

Red Hat OpenShift Container Platform release 4.12.40 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of...

Ingress NGINX Controller Code Injection Vulnerability

Ingress NGINX Controller is a Kubernetes open source entry controller for Kubernetes. A security vulnerability exists in Ingress NGINX Controller. An attacker could exploit this vulnerability to perform a code injection attack...

Ingress NGINX Controller Injection Vulnerability

Ingress NGINX Controller is a Kubernetes open source entry controller for Kubernetes. A security vulnerability exists in Ingress NGINX Controller. An attacker can exploit this vulnerability to execute arbitrary commands...

PT-2023-6604 · Unknown · Ingress-Nginx

Name of the Vulnerable Software and Affected Versions: ingress-nginx affected versions not specified Description: The issue is related to a controller vulnerability in the Kubernetes ingress-nginx cluster, which is associated with errors in processing input data. This can allow a remote attacker ...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.18 security update

Red Hat OpenShift Container Platform release 4.13.18 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...

This Week in Spring - October 24th, 2023

Hi, Spring fans! This week I'm in Lisbon, and Porto, Portugal, ahead of the Porto Tech Hub event in Porto, and my tour bus is about to leave! So, let's dive right into it! Spring Authorization Server 1.1.3, 1.0.4 and 0.4.4 available now Spring Authorization Server 1.2.0-RC1 available now Spring...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines 1.12.1 release and security update

Red Hat OpenShift Pipelines 1.12.1 has been released. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in t...

SUSE-SU-2023:4124-1 Security update for helm

This update for helm fixes the following issues: helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action FIX Default ServiceAccount yaml fixregistry: unswallow error remove useless print during prepareUpgrade fixregistry:...

Moderate: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.13 security and bug fix update

The Migration Toolkit for Containers MTC 1.7.13 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...