Security Bulletin: Multiple security vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

Summary Kubernetes is used by IBM Robotic Process Automation for Cloud Pak as part of it's base container images. CVE-2019-11254, CVE-2020-8565. Go Language x/text package is used by IBM Robotic Process Automation for Cloud Pak as part of it's operator. CVE-2020-14040. This bulletin identifies th...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.11.52 packages and security update

Red Hat OpenShift Container Platform release 4.11.52 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.11. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.11.52 bug fix and security update

Red Hat OpenShift Container Platform release 4.11.52 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.11. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.39 packages and security update

Red Hat OpenShift Container Platform release 4.12.39 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.39 bug fix and security update

Red Hat OpenShift Container Platform release 4.12.39 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

PT-2023-36270 · Unknown · Kubernetes Containerd

Name of the Vulnerable Software and Affected Versions: containerd affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the go 1.21 security release. Recommendations: At the moment, there is no information about a newer...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.17 packages and security update

Red Hat OpenShift Container Platform release 4.13.17 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.17 bug fix and security update

Red Hat OpenShift Container Platform release 4.13.17 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: kubevela, prometheus-adapter, kubernetes, k3s, rancher-webhook, caddy, kube-oidc-proxy, rancher-webhook-fips, up, kubernetes-fips, buildkitd, metrics-server-fips...

Runtime efficiency with Spring (today and tomorrow)

With Spring Framework 6.1 and Spring Boot 3.2 general availability approaching, we would like to share an overview about several efforts the Spring team is pursuing to allow developers to optimize the runtime efficiency of their applications. We are going to cover the following technologies and u...

CVE-2023-44487 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-15

CVE-2023-44487 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-15. A patched version of the package is available...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: k3s, kubernetes, prometheus-adapter, kubevela, buildkitd, up, caddy...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: kubevela, prometheus-adapter, kubernetes, k3s, rancher-webhook, caddy, kube-oidc-proxy, rancher-webhook-fips, up, kubernetes-fips, buildkitd, metrics-server-fips...

AZL-34900 CVE-2023-45142 affecting package kubernetes for versions less than 1.29.1-2

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: k3d, dynamic-localpv-provisioner-fips, prometheus-mongodb-exporter, yq, pulumi-language-yaml, kube-state-metrics-fips, kube-fluentd-operator, stakater-reloader, crossplane-provider-azure, nfs-subdir-external-provisioner-fips, kubernetes-dns-node-cache,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: k3d, dynamic-localpv-provisioner-fips, prometheus-mongodb-exporter, yq, pulumi-language-yaml, kube-state-metrics-fips, kube-fluentd-operator, stakater-reloader, crossplane-provider-azure, nfs-subdir-external-provisioner-fips, kubernetes-dns-node-cache,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: k3d, dynamic-localpv-provisioner-fips, pulumi-language-yaml, stakater-reloader, nfs-subdir-external-provisioner-fips, mc, vault-csi-provider, prometheus-stackdriver-exporter, nodetaint, aactl, fuse-overlayfs-snapshotter, volume-modifier-for-k8s-fips, rqlite, skaffold...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: nodetaint, newrelic-infrastructure-agent, cue, kubernetes-csi-livenessprobe, terraform-provider-azurerm, dynamic-localpv-provisioner, kubescape, certificate-transparency, slsa-verifier, nginx-mainline, pulumi, kubeflow, aactl, prometheus-adapter,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: nodetaint, newrelic-infrastructure-agent, cue, kubernetes-csi-livenessprobe, terraform-provider-azurerm, dynamic-localpv-provisioner, kubescape, certificate-transparency, slsa-verifier, nginx-mainline, pulumi, kubeflow, aactl, prometheus-adapter,...

AZL-31291 CVE-2023-44487 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-15

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...