AZL-39704 CVE-2024-28180 affecting package telegraf for versions less than 1.31.0-1

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-38130 CVE-2024-28180 affecting package telegraf for versions less than 1.29.4-8

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-35751 CVE-2024-28110 affecting package telegraf for versions less than 1.31.0-1

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When...

AZL-35761 CVE-2024-28110 affecting package telegraf for versions less than 1.28.5-5

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When...

CVE-2024-28110 vulnerabilities

Vulnerabilities for packages: falcosidekick, guac, falcosidekick-fips...

GHSA-5PF6-2QWX-PXM2 vulnerabilities

Vulnerabilities for packages: falcosidekick, guac...

GHSA-5PF6-2QWX-PXM2 vulnerabilities

Vulnerabilities for packages: falcosidekick, guac, falcosidekick-fips...

AZL-35752 CVE-2024-27304 affecting package telegraf for versions less than 1.31.0-1

pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. T...

AZL-35762 CVE-2024-27304 affecting package telegraf for versions less than 1.28.5-5

pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. T...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: trillian, trillian-fips, kube-bench-fips, step, amass, src, spicedb, temporal-server-fips, kots, step-ca, caddy, temporal-server, kine, argo-workflows-fips, falcosidekick-fips, k3s, wavefront-collector-for-kubernetes, kube-bench, argo-workflows, caddy-fips, ferretdb...

AZL-35763 CVE-2024-27289 affecting package telegraf for versions less than 1.29.4-4

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for ...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: amass, ferretdb, temporal-server, step, kine, k3s, trillian, kube-bench, src, kots, argo-workflows, step-ca, spicedb, caddy...

AZL-35750 CVE-2024-27289 affecting package telegraf for versions less than 1.31.0-1

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for ...

CVE-2024-27289 vulnerabilities

Vulnerabilities for packages: step, trillian, kots, argo-workflows, step-ca, caddy...

AZL-35599 CVE-2024-24786 affecting package telegraf for versions less than 1.29.4-8

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-eks, cert-exporter-fips, boring-registry, nfs-subdir-external-provisioner-fips, helm-operator, docker-compose, kustomize, vexctl, sigstore-scaffolding-fips, secrets-store-csi-driver-provider-gcp, nri-prometheus, zot, cilium,...

AZL-35673 CVE-2024-24786 affecting package telegraf for versions less than 1.31.0-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: amass, ferretdb, temporal-server, step, kine, k3s, trillian, kube-bench, src, kots, argo-workflows, step-ca, spicedb, caddy...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: trillian, trillian-fips, kube-bench-fips, step, amass, src, spicedb, temporal-server-fips, kots, step-ca, caddy, temporal-server, kine, argo-workflows-fips, falcosidekick-fips, k3s, wavefront-collector-for-kubernetes, kube-bench, argo-workflows, caddy-fips, ferretdb...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: trillian, trillian-fips, kube-bench-fips, step, amass, src, spicedb, temporal-server-fips, kots, step-ca, caddy, temporal-server, kine, argo-workflows-fips, falcosidekick-fips, k3s, wavefront-collector-for-kubernetes, kube-bench, argo-workflows, caddy-fips, ferretdb...