Design/Logic Flaw

kCTF is a Kubernetes-based infrastructure for capture the flag CTF competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark the...

CVE-2022-31055 Improper Access Control in kctf

kCTF is a Kubernetes-based infrastructure for capture the flag CTF competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark the...

CVE-2022-31055

Summary: CVE-2022-31055 relates to Google kCTF, a Kubernetes-based CTF infrastructure. Several connected sources confirm that prior to version 1.6.0 the kCTF cluster set-src-ip-ranges feature was broken, effectively allowing traffic from any IP due to improper access control. The issue was patche...

CVE-2022-31055 Improper Access Control in kctf

kCTF is a Kubernetes-based infrastructure for capture the flag CTF competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark the...

CVE-2022-31055 Improper Access Control in kctf

kCTF is a Kubernetes-based infrastructure for capture the flag CTF competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and allowed traffic from any IP. The problem has been patched in v1.6.0. As a workaround, those who want to test challenges privately can mark the...

cri-o: memory exhaustion on the node when access to the kube api

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.10.18 packages and security update

Red Hat OpenShift Container Platform release 4.10.18 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a...

Malicious code in kubernetes-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee30ca4230ba4f66db7921b6af3aeca14d192bc4ecdc7115aff0bbb912cf13b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4236 Malicious code in kubernetes-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee30ca4230ba4f66db7921b6af3aeca14d192bc4ecdc7115aff0bbb912cf13b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kubernetes-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32f0bf218a305dbf3c1cd86e6ea417e2c3c43aed723d3054398bc8efa8506553 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4238 Malicious code in kubernetes-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32f0bf218a305dbf3c1cd86e6ea417e2c3c43aed723d3054398bc8efa8506553 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Google kCTF 安全漏洞

Google kCTF is a Kubernetes-based CTF competition infrastructure from Google Google. kCTF v1.6.0 prior to the release of Google kCTF has an access control error vulnerability, which stems from the existence of improper access control in the kctf cluster, which can be exploited by attackers to...

Argo 缓冲区错误漏洞

Argo is an open source container native workflow engine. A buffer error vulnerability in Kubernetes Argo Events prior to version 1.7.1, which stems from ioutil.ReadAll reading all data into memory, can be exploited by an attacker to send a large number of requests to the Argo Events server,...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2022-1825)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1,...

EulerOS 2.0 SP10 : docker-engine (EulerOS-SA-2022-1820)

According to the versions of the docker-engine package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1,...

PacketStreamer - Distributed Tcpdump For Cloud Native Environments

Deepfence PacketStreamer is a high-performance remote packet capture and collection tool. It is used by Deepfence's ThreatStryker security observability platform to gather network traffic on demand from cloud workloads for forensic analysis. Primary design goals: Stay light, capture and stream, n...

Amazon Linux 2 : containerd (ALASDOCKER-2022-019)

The version of containerd installed on the remote host is prior to 1.4.13-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2022-019 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2022-020)

The version of containerd installed on the remote host is prior to 1.4.13-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2022-020 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daem...

Amazon Linux AMI : containerd (ALAS-2022-1600)

The version of containerd installed on the remote host is prior to 1.4.13-3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1600 advisory. A bug was found in containerd's CRI implementation where programs inside a container can cause the containerd daemon to consume...

A Bootiful Podcast: Kubernetes legend and friend Cora Iberkleid on Tanzu, Cartographer, and more

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to Kubernetes legend and fellow Tanzu Developer Advocate Cora Iberkleid @ciberkleid about Kubernetes and Cartographer supply chains...