CVE-2023-37264 Pipelines do not validate child UIDs

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

CVE-2023-37264 Pipelines do not validate child UIDs

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

PT-2023-25868 · Unknown · Tekton Pipelines

Name of the Vulnerable Software and Affected Versions: Tekton Pipelines versions 0.35.0 and later Description: The Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user...

GUAC 0.1 Beta: Google's Breakthrough Framework for Secure Software Supply Chains

Google on Wednesday announced the 0.1 Beta version of GUAC short for Graph for Understanding Artifact Composition for organizations to secure their software supply chains. To that end, the search giant is making available the open source framework as an API for developers to integrate their own...

Scientific Linux Security Update : samba on SL7.x i686/x86_64 (2023:1090)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2023:1090-1 advisory. - samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided CVE-2022-38023 Note that Nessus has not tested for this issue but has instead...

Scientific Linux Security Update : zlib on SL7.x i686/x86_64 (2023:1095)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2023:1095-1 advisory. - zlib: heap-based buffer over-read and overflow in inflate in inflate.c via a large gzip header extra field CVE-2022-37434 Note that Nessus has not teste...

Scientific Linux Security Update : git on SL7.x x86_64 (2023:0978)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2023:0978-1 advisory. - git: gitattributes parsing integer overflow CVE-2022-23521 - git: Heap overflow in git archive, git log format leading to RCE CVE-2022-41903 No...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2023:0812)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2023:0812-1 advisory. - Mozilla: Arbitrary memory write via PKCS 12 in NSS CVE-2023-0767 - Mozilla: Content security policy leak in violation reports using iframes...

Scientific Linux Security Update : libksba on SL7.x i686/x86_64 (2023:0530)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2023:0530-1 advisory. - libksba: integer overflow to code executiona CVE-2022-47629 Note that Nessus has not tested for this issue but has instead relied only on the...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2023:0296)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2023:0296-1 advisory. - Mozilla: libusrsctp library out of date CVE-2022-46871 - Mozilla: Arbitrary file read from GTK drag and drop on Linux CVE-2023-23598 - Mozilla:...

Scientific Linux Security Update : java-11-openjdk on SL7.x i686/x86_64 (2023:0195)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2023:0195-1 advisory. - OpenJDK: handshake DoS attack against DTLS connections JSSE, 8287411 CVE-2023-21835 - OpenJDK: soundbank URL remote loading Sound, 8293742...

Scientific Linux Security Update : xorg-x11-server on SL7.x i686/x86_64 (2023:0046)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2023:0046-1 advisory. - xorg-x11-server: X.Org Server XkbGetKbdByName use-after-free CVE-2022-4283 - xorg-x11-server: X.Org Server XTestSwapFakeInput stack overflow...

Scientific Linux Security Update : thunderbird on SL7.x x86_64 (2022:9079)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:9079-1 advisory. - Mozilla: Arbitrary file read from a compromised content process CVE-2022-46872 - Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and...

Scientific Linux Security Update : firefox on SL7.x i686/x86_64 (2022:9072)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:9072-1 advisory. - Mozilla: Arbitrary file read from a compromised content process CVE-2022-46872 - Mozilla: Memory safety bugs fixed in Firefox ESR 102.6 and...

Google Launches OSV-Scanner Tool to Identify Open Source Vulnerabilities

Google on Tuesday announced the open source availability of OSV-Scanner, a scanner that aims to offer easy access to vulnerability information about various projects. The Go-based tool, powered by the Open Source Vulnerabilities OSV database, is designed to connect "a project's list of dependenci...

Legitify - Detect And Remediate Misconfigurations And Security Risks Across All Your GitHub Assets

Strengthen the security posture of your GitHub organization! Detect and remediate misconfigurations, security and compliance issues across all your GitHub assets with ease Installation 1. You can download the latest legitify release from https://github.com/Legit-Labs/legitify/releases, each archi...

Scientific Linux Security Update : xorg-x11-server on SL7.x i686/x86_64 (2022:8491)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:8491-1 advisory. - xorg-x11-server: buffer overflow in GetCountedString in xkb/xkb.c CVE-2022-3550 - xorg-x11-server: memory leak in ProcXkbGetKbdByName in...

Scientific Linux Security Update : php-pear on SL7.x (noarch) (2022:7340)

The remote Scientific Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the SLSA-2022:7340-1 advisory. - ArchiveTar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked CVE-2020-28948 - ArchiveTar: improper filename...

Scientific Linux Security Update : pcs on SL7.x x86_64 (2022:7343)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:7343-1 advisory. - rubygem-rack: crafted requests can cause shell escape sequences CVE-2022-30123 - jquery: Prototype pollution in object's prototype leading to...

Scientific Linux Security Update : java-1.8.0-openjdk on SL7.x i686/x86_64 (2022:7002)

The remote Scientific Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the SLSA-2022:7002-1 advisory. - OpenJDK: excessive memory allocation in X.509 certificate parsing Security, 8286533 CVE-2022-21626 - OpenJDK: HttpServer no connection count...