WS-2023-0417

slsa-verifier vulnerable to mproper validation of npm's publish attestations...

GHSA-4F8R-QQR9-FQ8J vulnerabilities

Vulnerabilities for packages: gitsign, melange, trivy, cosign, neuvector-sigstore-interface, aactl, zot, wolfictl, spire-server, rekor, tekton-chains, vexctl, sigstore-scaffolding, apko, falcoctl, kubescape, slsa-verifier, policy-controller, zarf, gh, tkn, flux-source-controller...

CVE-2024-47534 vulnerabilities

Vulnerabilities for packages: gitsign, melange, trivy, cosign, neuvector-sigstore-interface, aactl, zot, wolfictl, spire-server, rekor, tekton-chains, vexctl, sigstore-scaffolding, apko, falcoctl, kubescape, slsa-verifier, policy-controller, zarf, gh, tkn, flux-source-controller...

CVE-2024-45395 vulnerabilities

Vulnerabilities for packages: gh, slsa-verifier, cosign...

CVE-2024-45395 vulnerabilities

Vulnerabilities for packages: gh, cosign-fips, cosign, slsa-verifier...

GHSA-CQ38-JH5F-37MQ vulnerabilities

Vulnerabilities for packages: gh, cosign-fips, cosign, slsa-verifier...

GHSA-CQ38-JH5F-37MQ vulnerabilities

Vulnerabilities for packages: gh, slsa-verifier, cosign...

GO-2023-2188 slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier...

GHSA-R2XV-VPR2-42M9 slsa-verifier vulnerable to mproper validation of npm's publish attestations

Summary slsa-verifier attestationstampered.json 5. SLSAVERIFIEREXPERIMENTAL=1 slsa-verifier verify-npm-package supreme-goggles.tgz --attestations-path attestationstampered.json --builder-id "https://github.com/actions/runner/github-hosted" --package-name "@trishankatdatadog/supreme-goggles"...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: chartmuseum, slsa-verifier, scorecard, bom, kubescape, paranoia, ctop, aactl, spire-server-fips, skaffold, k3s, kpt, falcoctl-fips, up, tekton-chains, k3d...

Google Expands Its Bug Bounty Program to Tackle Artificial Intelligence Threats

Google has announced that it's expanding its Vulnerability Rewards Program VRP to compensate researchers for finding attack scenarios tailored to generative artificial intelligence AI systems in an effort to bolster AI safety and security. "Generative AI raises new and different concerns than...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aactl, kubescape, k3d, slsa-verifier, cortex, spark-operator, terraform-provider-sendgrid, buildkitd, scorecard, kubevela, dgraph, src, up, kubeflow...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: up, prometheus-stackdriver-exporter, conftest-fips, volume-modifier-for-k8s-fips, kubescape, vault-csi-provider, aactl, bank-vaults-fips, kiam, smarter-device-manager-fips, terraform-provider-sendgrid, kubernetes-csi-livenessprobe-fips, cortex, k3d,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: metrics-server, wireguard-go, atlantis-fips, prometheus-elasticsearch-exporter, kubernetes-dashboard, up, configmap-reload-fips, gomplate, volume-modifier-for-k8s-fips, vault-k8s, cue, kubescape, vault-csi-provider, bank-vaults-fips, nodetaint,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kaf, terraform-provider-aws, git-lfs, newrelic-infrastructure-agent, k3d, hey, certificate-transparency, scorecard, secrets-store-csi-driver, nginx-stable, slsa-verifier, conftest, buildkitd, pulumi-language-java, minio, memcached-exporter, pulumi-language-dotnet,...

CVE-2023-37264

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

Pipelines do not validate child UIDs

Summary Pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child Task. We should add UID to PipelineRun status and validate that child Run status/results only come from Runs...

CVE-2023-37264

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

Design/Logic Flaw

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

CVE-2023-37264

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...