Important: nerdctl

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2 : nerdctl (ALAS-2025-2863)

The version of nerdctl installed on the remote host is prior to 2.0.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2863 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a...

Important: nerdctl

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Important: nerdctl

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Amazon Linux 2 : nerdctl (ALAS-2025-2821)

The version of nerdctl installed on the remote host is prior to 2.0.4-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2821 advisory. Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JS...

Medium: nerdctl

Issue Overview: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing...

Medium: nerdctl

Issue Overview: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: ctop, docker-cli-buildx, spegel, cert-manager-cmctl, k8sgpt, zot, cilium-cli, buildkitd, kots, chartmuseum, rancher-fleet, kubescape, xeol, eksctl, grype, opa-envoy, osv-scanner, skaffold, wolfictl, helm, envoy-gateway, kaniko, melange, trivy, helm-push, kargo,...

Amazon Linux 2 : nerdctl (ALAS-2025-2749)

The version of nerdctl installed on the remote host is prior to 2.0.3-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2749 advisory. Applications and libraries which misuse the ServerConfig.PublicKeyCallback callback may be susceptible to an authorization...

Amazon Linux 2 : nerdctl (ALAS-2024-2618)

The version of nerdctl installed on the remote host is prior to 1.7.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2618 advisory. 2024-08-28: CVE-2024-24790 was added to this advisory. A malicious HTTP sender can use chunk extensions to cause a receive...

Medium: nerdctl

Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...

Amazon Linux 2023 : nerdctl (ALAS2023-2024-700)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-700 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing...

Photon OS 3.0: Nerdctl PHSA-2023-3.0-0608

An update of the nerdctl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-3.0-0608. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Nerdctl PHSA-2023-5.0-0044

An update of the nerdctl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-0044. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: flux-kustomize-controller, skopeo, slsa-verifier, sops, grpc-health-probe, step, zot, guac, fulcio, kots, ko, caddy, dgraph, cloudflared, step-ca, tkn, kubescape, dex, weaviate, gitsign, bank-vaults, temporal-ui-server, rabbitmq-messaging-topology-operator, skaffold,...

CentOS 9 : runc-1.1.7-1.el9

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-1.el9 build changelog. - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless...

Amazon Linux 2023 : nerdctl (ALAS2023-2024-529)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-529 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...

Medium: nerdctl

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Medium: nerdctl

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: zarf, wolfictl, k3d, skopeo, ctop, docker, buildkitd, grype, skaffold, cadvisor, syft, kaniko, k3s, runc, nerdctl, podman, k9s, kots, zot, kubescape, kubernetes, trivy, newrelic-infrastructure-agent...