Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.9.48 extras security update

Red Hat OpenShift Container Platform release 4.9.48 is now available with updates to packages and images that fix several bugs. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.6.61 bug fix and security update

Red Hat OpenShift Container Platform release 4.6.61 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.6.61 security and extras update

Red Hat OpenShift Container Platform release 4.6.61 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a...

The vulnerability of Kubernets Rancher cluster management software lies in the storage of passwords in an unencrypted form, allowing attackers to gain access to user credentials, passwords, and API tokens.

The vulnerability of Kubernets Rancher cluster management software is related to the storage of passwords in an unencrypted form. Exploiting this vulnerability can allow a remote attacker to gain access to credentials, passwords, and API tokens...

The vulnerability of Kubernets Rancher cluster management software is related to deficiencies in the authentication process, which allows attackers to elevate their privileges.

The vulnerability of Kubernets Rancher cluster management software is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

The vulnerability of the Kubernetes cluster synchronization software, which relies on configuration sources like Flux and the Kubernetes package manager Helm, arises from improper resource cleanup or release mechanisms. This allows attackers to trigger service failures.

The vulnerability of the Kubernetes cluster synchronization software, which relies on configuration sources like Flux and the Kubernetes package manager Helm, is related to improper resource cleanup or release. Exploiting this vulnerability allows a malicious actor to cause service failures...

Integrating API Security and WAF into K8s Kong API Gateway

Article by Jiju Jacob, Director of Engineering at Revenera This is an update of Mr. Jacobs’ 05/23 post in his Medium blog. He is a Director of Engineering at Revenera. Revenera, born as InstallShield and now a Flexera company, helps software and technology companies use open source solutions more...

istio security update

istio 1.13.7-1 - Added Oracle specific files for 1.13.7-1 olcne 1.4.7-1 - Upgrade Istio from 1.13.5 to 1.13.7 to resolve the CVE-2022-31045 1.4.6-2 - Fix bug in gen-certs-helper script to change permission of node.key to allow opc user to copy over - Update gen-certs-helper script to skip printin...

CVE-2022-36049

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.11.3 packages and security update

Red Hat OpenShift Container Platform release 4.11.3 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.11. Red Hat Product Security has rated this update as having a...

CVE-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

CVE-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

CVE-2022-36049

Summary: CVE-2022-36049 affects Flux2 and its helm-controller. A defect in the Helm SDK allows crafted data inputs to trigger abnormally high memory usage, potentially causing the controller to panic and halt reconciliations in multi-tenant clusters. Affected versions: Flux2 v0.0.17 through v0.32...

CVE-2022-36049 Flux2 Helm Controller denial of service

Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK th...

CVE-2021-36782

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versio...

Information disclosure

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versio...

CVE-2021-36782 Rancher: Plaintext storage and exposure of credentials in Rancher API and cluster.management.cattle.io object

A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Members and User Base to use the Kubernetes API to retrieve plaintext version of sensitive data. This issue affects: SUSE Rancher Rancher versio...

CVE-2021-36782

CVE-2021-36782 concerns SUSE Rancher where sensitive fields, such as passwords, API keys and service account tokens, were stored in plaintext on Kubernetes objects (e.g., cluster.management.cattle.io) and exposed to authenticated users with cluster/project roles via the Kubernetes API. Affected R...

PT-2022-4760 · Suse · Suse Rancher

Name of the Vulnerable Software and Affected Versions: SUSE Rancher versions prior to 2.5.16 SUSE Rancher versions prior to 2.6.7 Description: The issue is related to the cleartext storage of sensitive information in SUSE Rancher, allowing authenticated users to retrieve plaintext versions of...

Rancher Labs Rancher 安全漏洞

Rancher Labs Rancher is a suite of open source, enterprise-grade container management platforms from Rancher Labs, Inc. in the United States. A security vulnerability exists in Rancher for SUSE versions 2.5.0 through 2.5.15 and 2.6.0 through 2.6.6, which stems from the explicit storage of sensiti...