CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: caddy, cosign, falcoctl, fulcio, rekor, nerdctl, wolfictl, kubernetes-dashboard, flux-source-controller, kots, temporal-ui-server, grpc-health-probe, terragrunt, skopeo, weaviate, skaffold, slsa-verifier, apko, argo-workflows, tekton-chains, ko,...

AZL-35837 CVE-2024-28180 affecting package cert-manager for versions less than 1.11.2-14

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-35875 CVE-2024-28180 affecting package cert-manager for versions less than 1.12.12-1

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, vault-csi-provider, kubernetes-dashboard, gomplate, timestamp-authority-fips, zarf, temporal, skaffold, step-ca, kubernetes-dashboard-fips, flux-source-controller, nerdctl, cosign, argo-workflows-fips, dgraph, kubescape,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: buf, secrets-store-csi-driver-provider-azure, aws-load-balancer-controller-fips, prometheus-beat-exporter-fips, prometheus-operator, crossplane-provider-aws-sns, ctop, crossplane-provider-aws-cloudwatchlogs, secrets-store-csi-driver-provider-aws, memcached-exporter,...

AZL-35635 CVE-2024-24786 affecting package cert-manager for versions less than 1.12.12-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35556 CVE-2024-24786 affecting package cert-manager for versions less than 1.11.2-14

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2023-48795 affecting package cert-manager for versions less than 1.11.2-7

CVE-2023-48795 affecting package cert-manager for versions less than 1.11.2-7. A patched version of the package is available...

GHSA-R53H-JV2G-VPX6 vulnerabilities

Vulnerabilities for packages: trivy, zarf, eksctl, kubescape, helm-operator, k9s, chartmuseum, helm-push, kots, up, zot, flux-helm-controller, kubevela, cilium-cli, flux-source-controller, k8sgpt...

AZL-34584 CVE-2024-26147 affecting package cert-manager for versions less than 1.12.13-1

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would...

AZL-34454 CVE-2024-26147 affecting package cert-manager for versions less than 1.11.2-10

Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an index.yaml file or a plugins plugin.yaml file were missing all metadata a panic would...

GHSA-V53G-5GJP-272R vulnerabilities

Vulnerabilities for packages: trivy, helm-operator, up, k9s, k8sgpt, kubevela, kots, chartmuseum, zarf, kubescape, flux-helm-controller, flux-source-controller, cilium-cli, eksctl, zot, helm-push...

CVE-2024-25620 vulnerabilities

Vulnerabilities for packages: trivy, zarf, eksctl, kubescape, helm-operator, k9s, chartmuseum, helm-push, kots, up, zot, flux-helm-controller, kubevela, cilium-cli, flux-source-controller, k8sgpt...

AZL-34355 CVE-2024-25620 affecting package cert-manager for versions less than 1.11.2-12

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the Chart.yaml file includes a relative path change, the chart would be saved outside its expected directory based on the...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: falcoctl, skopeo, cadvisor, kubescape, policy-controller-fips, vexctl, kots, flux, goreleaser, flux-helm-controller, buildkitd, kpt, argo-workflows, k8sgpt, slsa-verifier, ctop, policy-controller, helm, dagger, ko-fips, zot, helm-fips, trivy, cadvisor-fips,...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: falcoctl, skopeo, cadvisor, kubescape, policy-controller-fips, vexctl, kots, flux, goreleaser, flux-helm-controller, buildkitd, kpt, argo-workflows, k8sgpt, slsa-verifier, ctop, policy-controller, helm, dagger, ko-fips, zot, helm-fips, trivy, cadvisor-fips,...

GHSA-7WW5-4WQC-M92C vulnerabilities

Vulnerabilities for packages: kubescape, fuse-overlayfs-snapshotter, kots, flux-helm-controller, buildkitd, kaniko, cilium-cli, k8sgpt, gitness, ctop, helm, zot, trivy, eksctl, skaffold, grype, melange, up, flux-source-controller, helm-push, newrelic-infrastructure-agent, kubevela, k3d...

GHSA-45X7-PX36-X8W8 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws, buf, prometheus-mongodb-exporter, crossplane-provider-azure-sql, secrets-store-csi-driver-provider-azure, fq, vault-k8s, temporal-server, vault-csi-provider, nri-mssql, kubernetes, nsc, kube-state-metrics-fips, git-lfs, kubernetes-dashboard,...

AZL-34581 CVE-2023-48795 affecting package cert-manager for versions less than 1.12.12-1

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

AZL-32195 CVE-2023-48795 affecting package cert-manager for versions less than 1.11.2-7

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...