107 matches found
Photon OS 5.0: Nerdctl PHSA-2023-5.0-0044
An update of the nerdctl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-0044. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: grpc-health-probe, kube-rbac-proxy, kubernetes-dashboard, gomplate, flux-kustomize-controller, dgraph, fulcio, minio, nerdctl, k3s, skaffold, policy-controller, step-ca, kubescape, terragrunt, kots, weaviate, frp, sigstore-scaffolding, tkn, tekton-chains, guac,...
CentOS 9 : runc-1.1.7-1.el9
The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-1.el9 build changelog. - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless...
Amazon Linux 2023 : nerdctl (ALAS2023-2024-529)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-529 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...
Medium: nerdctl
Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...
Medium: nerdctl
Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...
CVE-2024-21626 vulnerabilities
Vulnerabilities for packages: syft, runc, newrelic-infrastructure-agent, skaffold, nerdctl, k3s, podman, buildkitd, kubescape, kots, kaniko, docker, k3d, zarf, zot, skopeo, kubernetes, grype, cadvisor, trivy, wolfictl, k9s, ctop...
CVE-2024-21626 vulnerabilities
Vulnerabilities for packages: kubescape, buildkitd, kots, ctop, newrelic-infrastructure-agent, syft, docker, trivy, grype, kubernetes, skopeo, kaniko, wolfictl, k3d, podman, zot, runc, k9s, k3s, zarf, cadvisor, nerdctl, skaffold...
Important: nerdctl
Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Text nodes not in the HTML namespace are incorrectly literally rendered,...
Amazon Linux 2 : nerdctl (ALAS-2023-2339)
The version of nerdctl installed on the remote host is prior to 1.6.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2339 advisory. 2024-02-01: CVE-2023-3978 was added to this advisory. The HTTP/2 protocol allows a denial of service server resource...
Amazon Linux 2023 : nerdctl (ALAS2023-2023-366)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-366 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Tenable has extracted the precedi...
Medium: nerdctl
Issue Overview: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Affected Packages: nerdctl Issue Correction: Run dnf update nerdctl --releasever 2023.2.20231002 or dnf update...
Important: nerdctl
Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send...
Amazon Linux 2023 : nerdctl (ALAS2023-2023-313)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-313 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...
Amazon Linux 2 : nerdctl (ALAS-2023-2210)
The version of nerdctl installed on the remote host is prior to 1.1.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2210 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a...
Medium: nerdctl
Issue Overview: 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192...
Amazon Linux 2 : nerdctl (ALAS-2023-2193)
The version of nerdctl installed on the remote host is prior to 1.1.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2193 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the...
Important: nerdctl
Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send...
