AZL-35116 CVE-2023-45142 affecting package prometheus for versions less than 2.45.4-1

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: hey, dex, prometheus-elasticsearch-exporter, crossplane-provider-azure, k3d, dex-k8s-authenticator, prometheus-postgres-exporter-fips, k8sgpt, kpt, aactl, frp, minio, node-problem-detector, vault-k8s-fips, dynamic-localpv-provisioner, thanos-operator,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: flux-image-automation-controller, atlantis, kubeflow-katib, runc, ollama, bom, gomplate, vertical-pod-autoscaler, flux, kubernetes-dashboard, prometheus-adapter, pulumi-kubernetes-operator, gitness, hugo, crossplane-provider-aws, helm, kots, kaf,...

AZL-50339 CVE-2023-39325 affecting package prometheus for versions less than 2.37.9-2

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

AZL-35121 CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: hey, dex, prometheus-elasticsearch-exporter, crossplane-provider-azure, k3d, dex-k8s-authenticator, prometheus-postgres-exporter-fips, k8sgpt, kpt, aactl, frp, minio, node-problem-detector, vault-k8s-fips, dynamic-localpv-provisioner, thanos-operator,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: atlantis, kubeflow-katib, ollama, bom, gomplate, prometheus-adapter, pulumi-kubernetes-operator, gitness, hugo, helm, kots, kaf, grype, pulumi-language-java, pulumi-language-dotnet, k3d, aactl, nghttp2, grpcurl, flux-notification-controller, nodetaint, terraform,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: hey, dex, prometheus-elasticsearch-exporter, k3d, kpt, terraform-provider-aws, aactl, frp, minio, node-problem-detector, vault-k8s-fips, dynamic-localpv-provisioner, pulumi-language-yaml, pulumi-language-dotnet, gobuster, amass, metrics-server-fips,...

AZL-31341 CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-31342 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35114 CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35117 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: atlantis, kubeflow-katib, ollama, bom, gomplate, prometheus-adapter, pulumi-kubernetes-operator, gitness, hugo, helm, kots, kaf, grype, pulumi-language-java, pulumi-language-dotnet, k3d, aactl, nghttp2, grpcurl, flux-notification-controller, nodetaint, terraform,...

Debian: Security Advisory (DLA-3609-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3609-1] prometheus-alertmanager security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3609-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucaries October 08, 2023 https://wiki.debian.org/LTS -...

Debian dla-3609 : golang-github-prometheus-alertmanager-dev - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3609 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3609-1 [email protected] https://www.debian.org/lts/security/...

DLA-3609-1 prometheus-alertmanager - security update

Bulletin has no description...

SUSE SLED15: golang-github-prometheus-alertmanager / etc (SUSE-SU-2023:3888-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3888-1 advisory. golang-github-prometheus-alertmanager: - CVE-2023-29409: Restrict RSA keys in certificates to less than o...

SUSE: Security Advisory (SUSE-SU-2023:3888-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 15: golang-github-QubitProducts-exporter_exporter / etc (SUSE-SU-2023:3868-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3868-1 advisory. golang-github-lusitaniae-apacheexporter: - Security issues fixed: CVE-2022-32149: Fix denial of service vulnerability bsc1204501 CVE-2022-41723: Fix...