114 matches found
CLEANSTART-2026-KS00115 Security fixes in opentofu-fips 1.7.10-r3
Package opentofu-fips version 1.7.10-r3 fixes 2 vulnerabilities: ghsa-p77j-4mvh-x3m3, CVE-2026-33186...
CLEANSTART-2026-AT41104 Security fixes in opentofu-fips 1.8.11-r3
Package opentofu-fips version 1.8.11-r3 fixes 2 vulnerabilities: ghsa-p77j-4mvh-x3m3, CVE-2026-33186...
CLEANSTART-2026-QW04025 Security fixes in opentofu-fips 1.11.5-r3
Package opentofu-fips version 1.11.5-r3 fixes 16 vulnerabilities: ghsa-78h2-9frx-2jm8, CVE-2026-34986, ghsa-hfvc-g4fc-pqhx, CVE-2026-39883, ghsa-w8rr-5gcm-pp58...
GHSA-X527-X647-Q7GG vulnerabilities
Vulnerabilities for packages: gitea, containerd, k9s, traefik, kubescape-server, minio, knative-serving-fips, argocd-image-updater, argo-cd, gatekeeper, kyverno-fips, nerdctl, kube-arangodb-fips, k3s, calico-fips, trivy-fips, minio-fips, argocd-image-updater-fips, cloud-provider-aws,...
GHSA-45GG-VH54-H5M9 vulnerabilities
Vulnerabilities for packages: gitea, containerd, k9s, traefik, kubescape-server, minio, knative-serving-fips, argocd-image-updater, argo-cd, gatekeeper, kyverno-fips, nerdctl, kube-arangodb-fips, k3s, calico-fips, trivy-fips, minio-fips, argocd-image-updater-fips, cloud-provider-aws,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: gitea, step-issuer, buildah, clickhouse-backup-fips, containerd, falcoctl-fips, cluster-api-azure-controller, k9s, kubescape-server, minio, traefik, terragrunt, knative-serving-fips, atlantis-fips, step-kms-plugin-fips, argocd-image-updater, argo-cd, cosign,...
GHSA-78MQ-XCR3-XM33 vulnerabilities
Vulnerabilities for packages: gitea, containerd, k9s, traefik, kubescape-server, minio, terragrunt, knative-serving-fips, argocd-image-updater, argo-cd, gatekeeper, kyverno-fips, nerdctl, kube-arangodb-fips, k3s, syft-fips, calico-fips, trivy-fips, minio-fips, argo-events,...
GHSA-9M57-25V3-79X9 vulnerabilities
Vulnerabilities for packages: buildah, containerd, traefik, minio, knative-serving-fips, argo-cd, gatekeeper, kyverno-fips, nerdctl, kube-arangodb-fips, k3s, calico-fips, cloud-provider-aws, argo-workflows-fips, zot, cert-manager, frankenphp-8.5, knative-kafka-broker-fips, kots, tekton-pipelines,...
GHSA-W879-237Q-WC7R vulnerabilities
Vulnerabilities for packages: scorecard, flux-kustomize-controller, step-issuer, step, external-dns, flux, slsa-verifier, guac, neuvector-sigstore-interface, crossplane-provider-family-azure, pulumi, opentelemetry-collector, melange, kine, gitea, k8sgpt, osv-scanner, steampipe, openbao,...
GO-2026-5705 OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu
OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree in github.com/opentofu/opentofu...
GO-2026-5571 OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu
OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL in github.com/opentofu/opentofu...
GO-2026-5558 OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu
OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server in github.com/opentofu/opentofu...
GO-2026-5441 OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu
OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with maliciously-crafted dependency responses in github.com/opentofu/opentofu...
GHSA-Q7J3-V8QV-22VQ OpenTofu: Possible arbitrary file read during certain git operations via a maliciously crafted URL
Impact Possible data exposure. Summary While downloading packages from a maliciously crafted URL, some git operations against that URL could allow arbitrary file read. This might allow disclosure of confidential information. Details OpenTofu relies on go-getter for downloading packages like...
GHSA-PXH5-6RRC-8RJV vulnerabilities
Vulnerabilities for packages: opentofu...
GHSA-PXH5-6RRC-8RJV vulnerabilities
Vulnerabilities for packages: opentofu, opentofu-fips...
OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server
Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...
GHSA-PXH5-6RRC-8RJV OpenTofu: Excessive resource usage in "tofu init" when installing dependencies from attacker-controlled server
Impact Unauthenticated denial of service. Summary When installing provider or module packages from attacker-controlled servers, the server may cause tofu initto enter an infinite loop sending garbage data to that server. Those who depend on modules or providers served from untrusted third-party...