Kubernetes: Index Out Of Bounds in protobuf unmarshalling

Report Submission Form Summary: I have recently discovered a bug in the gogo/protobuf code generator. This bug allows for an index out of bounds when unmarshalling certain protobuf objects. The bug is that a check is lacking when skipping certain bytes. There are numerous occurrences of this bug...

Insecure Access Controls

Xen is vulnerable to denial of service. Unprivileged guest users are able to obtain and modify permissions, list and delete root nodes. This is due to permissions that are not properly enforced...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2020–15257)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in containerd that could allow containers running in the host network namespace as root UID 0 to gain the host root privileges CVE-2020–15257 Vulnerability Details CVEID: CVE-2020-15257 Description: Containerd could allo...

CVE-2020-29481

An issue was discovered in Xen through 4.14.x. Access rights of Xenstore nodes are per domid. Unfortunately, existing granted access rights are not removed when a domain is being destroyed. This means that a new domain created with the same domid will inherit the access rights to Xenstore nodes...

NICER Protocol Deep Dive: Internet Exposure of etcd

Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...

CVE-2020-27151

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

Input validation

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

CVE-2020-27151

An issue was discovered in Kata Containers through 1.11.3 and 2.x through 2.0-rc1. The runtime will execute binaries given using annotations without any kind of validation. Someone who is granted access rights to a cluster will be able to have kata-runtime execute arbitrary binaries as root on th...

CVE-2020-26241

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy at 0x00...04 contract di...

CVE-2020-26241 Shallow copy bug in geth

Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy at 0x00...04 contract di...

openGauss: Configuring Kerberos Authentication in openGauss

Use gsom to enable and disable Kerberos authentication in openGauss. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

GaussDB Kernel: Prohibiting host Entries (Except Intra-Cluster Nodes) from Using Trust Authentication in the pg_hba.conf File

Cluster nodes are deployed on the secure intranet. Only the communications between intra-cluster nodes are allowed to use trust authentication. Trust authentication assumes that all users who can connect to the cluster server nodes can access the database. This method is applied only when all use...

GaussDB Kernel: Configuring Node Connections in the pg_hba.conf File of DNs in the Cluster

Cluster nodes are deployed on the secure intranet. A DN allows communications only within the cluster. The pghba.conf file of a DN stores only configurations of intra-cluster node connections and trusted internal security connections. Copyright C 2020 Greenbone Networks GmbH Some text description...

openGauss: Prohibiting host Entries (Except Intra-openGauss Nodes) from Using Trust Authentication in the pg_hba.conf File

openGauss nodes are deployed on the secure intranet. Only the communications between intra-openGauss nodes are allowed to use trust authentication. Trust authentication assumes that all users who can connect to the openGauss server nodes can access the database. This method is applied only when a...

openGauss: Configuring Node Connections in the pg_hba.conf File of the Database Node in openGauss

openGauss nodes are deployed on the secure intranet. Database nodes cannot be connected to or accessed through the internet. They can be connected only to nodes in the openGauss. The pghba.conf file of the database nodes stores only configurations of intra-openGauss node connections and trusted...

NICER Protocol Deep Dive: Internet Exposure of Remote Desktop (RDP)

Welcome to the NICER Protocol Deep Dive blog series! When we started researching what all was out on the internet way back in January, we had no idea we'd end up with a hefty, 137-page tome of a research report. The sheer length of such a thing might put off folks who might otherwise learn a thin...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes kubelet security vulnerability (CVE-2020-8557)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in the Kubernetes kubelet that could result in the denial of service of a node CVE-2020-8557 Vulnerability Details CVEID: CVE-2020-8557 Description: Kubernetes kubelet is vulnerable to a denial of service, caused by an...

Basics of Keeping Kubernetes Clusters Secure Part 2

We outline security mitigations and settings that should be prioritized in a clustered environment. The second part of our security guide on Kubernetes clusters covers best practices related to worker nodes, the kubelet, pods, and audit logs...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a GNU GRUB2 security vulnerability (CVE-2020-10713)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in GNU GRUB2 that could allow a local authenticated attacker to execute arbitrary code on the system. CVE-2020-10713 Vulnerability Details CVEID: CVE-2020-10713 Description: GNU GRUB2 could allow a local authenticated...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a GNU GRUB2 security vulnerability (CVE-2020-10713)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in GNU GRUB2 that could allow a local authenticated attacker to execute arbitrary code on the system. CVE-2020-10713 Vulnerability Details CVEID: CVE-2020-10713 Description: GNU GRUB2 could allow a local authenticated...