Linux Distros Unpatched Vulnerability : CVE-2023-40577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the...

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the Content-Length) is passed to the function cfl_sds_len, which in turn tries to cast a NULL pointer into struct cfl_sds. This is related to process_payload_metrics_ng() at prom_rw_prot.c.

...

AZL-57335 CVE-2025-22868 affecting package prometheus for versions less than 2.45.4-10

An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing...

The vulnerability of the Prometheus Remote Write plugin for collecting and processing Fluent Bit logs, related to the assignment of a zero pointer, allows a malicious actor to trigger a service failure.

The vulnerability of the Prometheus Remote Write plugin for collecting and processing Fluent Bit logs is related to the assignment of a null pointer. Exploiting this vulnerability could allow an attacker to cause a service failure by sending a specially crafted HTTP request...

GHSA-3WHM-J4XM-RV8X vulnerabilities

Vulnerabilities for packages: neuvector-dbgen, nats-server, rclone, cloud-provider-aws, crossplane-provider-aws-cloudwatchlogs, grafana-agent-operator, chezmoi, victoriametrics-cluster, terraform-provider-azurerm, nri-couchbase, prometheus-alertmanager, trust-manager, grpc-health-probe, kubevela,...

GHSA-49GW-VXVF-FC2G vulnerabilities

Vulnerabilities for packages: neuvector-dbgen, nats-server, rclone, grafana-agent-operator, pulumi-kubernetes-operator, chezmoi, terraform-provider-azurerm, nri-couchbase, prometheus-alertmanager, trust-manager, grpc-health-probe, kubevela, ctop, ytt, render-template, kargo, spire-server,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: nats-server, vexctl, newrelic-infrastructure-agent, pulumi-kubernetes-operator, stakater-reloader, nri-elasticsearch, nri-memcached, nri-couchbase, prometheus-alertmanager, docker-credential-acr-env, flux, yam, kubevela, gobuster,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: nats-server, vexctl, newrelic-infrastructure-agent, pulumi-kubernetes-operator, stakater-reloader, nri-elasticsearch, nri-memcached, nri-couchbase, prometheus-alertmanager, docker-credential-acr-env, flux, yam, kubevela, gobuster,...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: prometheus-mysqld-exporter, pulumi-kubernetes-operator, kubernetes-dashboard-fips, docker-credential-acr-env, nri-couchbase, cue-fips, kube-logging-logging-operator, kube-oidc-proxy, minio-fips, nerdctl, configmap-reload, protoc-gen-go-grpc, pulumi, cert-exporter-fip...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: prometheus-mysqld-exporter, pulumi-kubernetes-operator, kubernetes-dashboard-fips, docker-credential-acr-env, nri-couchbase, cue-fips, kube-logging-logging-operator, kube-oidc-proxy, minio-fips, nerdctl, configmap-reload, protoc-gen-go-grpc, pulumi, cert-exporter-fip...

GHSA-8XFX-RJ4P-23JM vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-fips, crossplane-provider-aws-memorydb, authservice, crossplane-provider-aws-sqs, fulcio, kube-logging-logging-operator, protoc-gen-go-grpc, neuvector, trivy-fips, crossplane-provider-aws-eks, cert-exporter-fips, mailpit, goreleaser, terraform,...

GHSA-J7VJ-RW65-4V26 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-fips, crossplane-provider-aws-memorydb, authservice, crossplane-provider-aws-sqs, fulcio, kube-logging-logging-operator, protoc-gen-go-grpc, neuvector, trivy-fips, crossplane-provider-aws-eks, cert-exporter-fips, mailpit, goreleaser, terraform,...

GHSA-5FQ7-4MXC-535H vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-fips, fulcio, cert-exporter-fips, metacontroller, influx, nats-server, mc-fips, tfsec, gotenberg, logstash-exporter-fips, step-ca-fips, cilium-cli, policy-controller-fips, confluent-common-docker, vault, volume-modifier-for-k8s-fips, trivy, runc,...

GHSA-3F6R-QH9C-X6MM vulnerabilities

Vulnerabilities for packages: podman, kubernetes-dashboard-fips, kube-logging-logging-operator, protoc-gen-go-grpc, neuvector, cilium-envoy-fips, terraform, crossplane-provider-sql, kustomize-fips, sqlexporter-fips, kubernetes-ingress-defaultbackend-fips, kuma, metacontroller,...

CVE-2022-3162 affecting package prometheus-adapter for versions less than 0.10.0-17

CVE-2022-3162 affecting package prometheus-adapter for versions less than 0.10.0-17. A patched version of the package is available...

Azure Linux 3.0 Security Update: cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter (CVE-2022-3162)

The version of cert-manager / keda / kube-vip-cloud-provider / prometheus-adapter installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-3162 advisory. - Users authorized to list or watch one type of...

CVE-2023-45288 affecting package prometheus-node-exporter for versions less than 1.7.0-2

CVE-2023-45288 affecting package prometheus-node-exporter for versions less than 1.7.0-2. A patched version of the package is available...

CVE-2024-50608

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user with access t...

AZL-57092 CVE-2024-50608 affecting package fluent-bit for versions less than 3.0.6-2

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user with access t...

CVE-2024-50608

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on an IP address and port, one can send a packet with Content-Length: 0 and it crashes the server. Improper handling of the case when Content-Length is 0 allows a user with access t...