CVE-2020-28852 affecting package multus for versions less than 4.0.2-1

CVE-2020-28852 affecting package multus for versions less than 4.0.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2020-28851 affecting package multus for versions less than 4.0.2-1

CVE-2020-28851 affecting package multus for versions less than 4.0.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-38561 affecting package multus for versions less than 4.0.2-1

CVE-2021-38561 affecting package multus for versions less than 4.0.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-45288 affecting package multus for versions less than 4.0.2-3

CVE-2023-45288 affecting package multus for versions less than 4.0.2-3. A patched version of the package is available...

AZL-42864 CVE-2023-45288 affecting package multus for versions less than 4.0.2-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-39550 CVE-2023-45288 affecting package multus for versions less than 4.0.2-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2023-44487 affecting package multus for versions less than 3.8-12

CVE-2023-44487 affecting package multus for versions less than 3.8-12. A patched version of the package is available...

olcne security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build 2.1.3.3 - Add OL9 support 2.1.3.2 - Update inline with Linux team building conmon for all but OL7. cri-o...

CVE-2023-44487 affecting package multus for versions less than 3.8-12

CVE-2023-44487 affecting package multus for versions less than 3.8-12. A patched version of the package is available...

CVE-2023-39325 affecting package multus for versions less than 3.8-12

CVE-2023-39325 affecting package multus for versions less than 3.8-12. A patched version of the package is available...

AZL-31859 CVE-2023-39325 affecting package multus for versions less than 3.8-12

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

AZL-42861 CVE-2023-39325 affecting package multus for versions less than 4.0.2-3

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

AZL-31331 CVE-2023-44487 affecting package multus for versions less than 3.8-12

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35015 CVE-2023-44487 affecting package multus for versions less than 3.8-12

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-31858 CVE-2023-3978 affecting package multus for versions less than 4.0.2-5

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

AZL-42867 CVE-2023-3978 affecting package multus for versions less than 4.0.2-2

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

kubernetes security update

kubernetes 1.25.11-1 - Added Oracle specific build files for Kubernetes olcne 1.6.2-1 - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x 1.6.1-9 - Updated the CVE ID's in Istio-1.16.4 changelog entry 1.6.1-8 - Update Istio...

kubernetes security update

kubernetes 1.25.11-1 - Added Oracle specific build files for Kubernetes olcne 1.6.2-1 - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x 1.6.1-9 - Updated the CVE ID's in Istio-1.16.4 changelog entry 1.6.1-8 - Update Istio...

AZL-41221 CVE-2021-38561 affecting package multus for versions less than 4.0.2-1

golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack...

AZL-35016 CVE-2022-32149 affecting package multus for versions less than 4.0.2-1

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...