Low: Red Hat Security Advisory: OpenShift Container Platform 4.4.11 ose-azure-machine-controllers-container security update

An update for ose-azure-machine-controllers-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Low: Red Hat Security Advisory: OpenShift Container Platform 4.4.11 atomic-openshift-descheduler-container security update

An update for atomic-openshift-descheduler-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CloudBees Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin Code Issue Vulnerability

CloudBees Jenkins Hudson Labs is a set of Java-based development of continuous integration tools from the U.S. company CloudBees. The product is mainly used to monitor continuous software version release/testing projects and some timed tasks.ElasticBox Jenkins Kubernetes CI/CD Plugin is used in...

PT-2020-20208 · Kubernetes +1 · Kubernetes +1

Name of the Vulnerable Software and Affected Versions: Kubernetes versions 1.1.0 through 1.16.10 Kubernetes versions 1.17.0 through 1.17.6 Kubernetes versions 1.18.0 through 1.18.3 Description: A security issue in the Kubelet and kube-proxy components allows adjacent hosts to reach TCP and UDP...

CVE-2020-2211

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2211

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Remote code execution

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-2211

CVE-2020-2211 affects Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin (versions ≤ 1.3). The root cause is that the YAML parser is not configured to prevent instantiation of arbitrary types, enabling remote code execution. The CVE entry notes a questionable attack surface but does not provide e...

CVE-2020-2211

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

CVE-2020-5911

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system...

CVE-2020-5911

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system...

Design/Logic Flaw

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system...

CVE-2020-5911

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system...

CVE-2020-5911

In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system...

CVE-2020-5911

The CVE-2020-5911 issue affects NGINX Controller installer on Debian/Ubuntu, where versions 3.0.0–3.5.0, 2.0.0–2.9.0, and 1.0.1 download Kubernetes packages over HTTP, enabling MITM risks. The associated advisory from F5 lists vulnerable versions and states fixes were introduced in 3.6.0; remedia...

PT-2020-15426 · Jenkins · Jenkins Elasticbox Jenkins Kubernetes Ci/Cd Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin versions 1.3 and earlier Description: The issue is related to the YAML parser configuration in the Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin, which allows the instantiation of...

Security fix for the ALT Linux 10 package kubernetes version 1.18.5-alt1

July 2, 2020 Mikhail Gordeev 1.18.5-alt1 - 1.18.5 - Fixes: CVE-2020-8558...

How To Protect Your Kubernetes Cluster with Wallarm – part 1 of 3

Kubernetes clusters enable an organization to easily take advantage of containerization. While this is a huge asset, it also creates security issues. Many organizations lack visibility into the applications within their Kubernetes cluster and their attack surface. Within a Kubernetes cluster, an...

kubernetes: YAML parsing vulnerable to "Billion Laughs" attack, allowing for remote denial of service

A flaw was found kubernetes. The parsing of YAML manifests by the Kubernetes API server could lead to a denial-of-service attack leaving it vulnerable to an instance of a "billion laughs" attack. The highest threat from this vulnerability is to system availability...

Important: Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1 servicemesh-operator security update

An update for servicemesh-operator is now available for OpenShift Service Mesh 1.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...