264 matches found
GHSA-C66W-HQ56-4Q97 Network policy may be bypassed by some ICMP Echo Requests
Impact Under certain conditions, ICMP Echo Request sent to a Cilium endpoint from an actor may bypass a network policy which disallows access from the actor to the endpoint, but allows from the endpoint to the actor. This does NOT apply to UDP and TCP traffic. The actor is either a pod or a clust...
Network policy may be bypassed by some ICMP Echo Requests
Impact Under certain conditions, ICMP Echo Request sent to a Cilium endpoint from an actor may bypass a network policy which disallows access from the actor to the endpoint, but allows from the endpoint to the actor. This does NOT apply to UDP and TCP traffic. The actor is either a pod or a clust...
Kubernetes Namespaces Are Not as Secure as You Think
In a previous article, we described how the usage of namespaces in Kubernetes significantly simplifies the management of a Kubernetes cluster. However, managing multiple microservices on the same cluster comes with a security cost when not planned correctly. A common misconception around namespac...
Gatekeeper - First Open-Source DDoS Protection System
Gatekeeper is the first open source DoS protection system. It is designed to scale to any peak bandwidth, so it can withstand DoS attacks both of today and of tomorrow. In spite of the geographically distributed architecture of Gatekeeper, the network policy that describes all decisions that have...
DEBIAN-CVE-2020-16022
Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially bypass firewall controls via a crafted HTML page...
Google Chrome Security Vulnerability
Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in versions prior to Google chrome 87.0.4280.66, which stems from insufficient policy enforcement in the network...
chromium-browser: Insufficient policy enforcement in networking
Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page...
Google Android Permission License and Access Control Issues Vulnerability
Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. A security vulnerability exists in Android-11 version NetworkPolicyManagerService. The vulnerability stems from a lack of privilege checking, allowing an attacker to bypass privileges. This leads...
Linux kernel out-of-bounds array access vulnerability
Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in Linux kernel versions prior to 5.0.19, which stems from verifynewpolicyinfo in the net/xfrm/xfrmuser.c file failing to properly hand...
Security Bulletin: IBM Cloud Kubernetes Service is impacted by a security vulnerability in Project Calico
Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in Project Calico, the network CNI plugin used in IBM Cloud Kubernetes Service, which could result in weaker than expected network policy protection. Vulnerability Details CVEID: None available DESCRIPTION: Project Calic...
The vulnerability of the Identity Services Engine, a platform for managing network policies, exposes the Cisco Prime Infrastructure monitoring and management system to attacks from insiders. This allows attackers to carry out “man-in-the-middle” type attacks.
The vulnerability of the Identity Services Engine, a platform for managing network policies, is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker operating remotely to carry out a “man-in-the-middle” attack...
Mesosphere Marathon Web UI Public WAN (Internet) / Public LAN Accessible
The script checks if the Mesosphere Marathon Web UI is accessible from a public WAN Internet / public LAN. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Red Hat atomic-openshift denial of service vulnerability
Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that builds, tests, deploys, and runs applications. atomic-openshift is an interactive component of it. A security vulnerability exists in Red Hat atomic-openshift versions prior to 3.10.9. An attacker c...
Code injection
In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service DoS attack on an Openshift 3.9, or 3.7 Cluster...
CVE-2018-10885
In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service DoS attack on an Openshift 3.9, or 3.7 Cluster...
CVE-2018-10885
In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service DoS attack on an Openshift 3.9, or 3.7 Cluster...
CVE-2018-10885
A malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service DoS attack on an Openshift 3.7 or 3.9 Cluster. Mitigation Use an alternative plugin such as ovs-subnet, or ovs-multitentant...
Gemalto SafeNet Authentication Service for NPS Agent Elevation of Privilege Vulnerability
Gemalto SafeNet Authentication Service for NPS Agent is a network access policy agent from Gemalto USA. A security vulnerability exists in Gemalto SafeNet Authentication Service for NPS Agent due to the program's use of weak access control lists for installation directories and executable modules...
SUSE-SU-2017:3300-1 Security update for the Linux Kernel (Live Patch 10 for SLE 12 SP2)
This update for the Linux Kernel 4.4.74-9229 fixes several issues. The following security issues were fixed: - CVE-2017-1000405: Problematic use of pmdmkdirty in the touchpmd function allowed users to overwrite read-only huge pages e.g. the zero huge page and sealed shmem files bsc1070307. -...
