AZL-34585 CVE-2023-6337 affecting package cert-manager for versions less than 1.12.12-1

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of...

CVE-2023-46100 Cert manager has a use of uninitialized resource vulnerability

in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource...

CVE-2023-46100 Cert manager has a use of uninitialized resource vulnerability

in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.12.1

cert-manager Operator for Red Hat OpenShift 1.12.1 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.11.5

cert-manager Operator for Red Hat OpenShift 1.11.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: buildkitd, kubernetes-csi-external-resizer, metrics-server, temporal-server, k3s, kubernetes, kubevela, kubescape, kine, envoy-ratelimit, temporal, volume-modifier-for-k8s, cri-tools, docker-compose...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: kubescape, paranoia, aactl, chartmuseum, ctop, scorecard, k3s, tekton-chains, slsa-verifier, k3d, spire-server-fips, up, skaffold, kpt, bom, falcoctl-fips...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: plutono-fips, bank-vaults-fips, aactl, prometheus-blackbox-exporter, prometheus-stackdriver-exporter, kube-oidc-proxy, terraform-provider-sendgrid, kiam, buildkitd, conftest-fips, k3d, kubeflow-fips, spark-operator, src, timestamp-authority-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aactl, buildkitd, terraform-provider-sendgrid, dgraph, scorecard, kubevela, kubescape, spark-operator, up, src, slsa-verifier, kubeflow, cortex, k3d...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: kubernetes, caddy, rancher-webhook-fips, k3s, kubernetes-fips, kubevela, up, kube-oidc-proxy, prometheus-adapter, buildkitd, metrics-server-fips, rancher-webhook...

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is available...

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is available...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: buildkitd, k3s, kubernetes, kubevela, prometheus-adapter, up, caddy...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: kubernetes, caddy, rancher-webhook-fips, k3s, kubernetes-fips, kubevela, up, kube-oidc-proxy, prometheus-adapter, buildkitd, metrics-server-fips, rancher-webhook...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, dive, prometheus-operator, tkn, prometheus-alertmanager, dynamic-localpv-provisioner, haproxy-ingress, frp, prometheus-adapter, metrics-server, nfs-subdir-external-provisioner, buildkitd, kiam, chartmuseum, gke-gcloud-auth-plugin,...

AZL-34588 CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

AZL-31639 CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, flux-source-controller, ko, haproxy-ingress, dynamic-localpv-provisioner, terraform-provider-aws, kots, flux-notification-controller, flux-kustomize-controller, bom, dgraph, certificate-transparency, hey, kind, aws-efs-csi-driver, minio,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, flux-source-controller, ko, haproxy-ingress, dynamic-localpv-provisioner, terraform-provider-aws, kots, flux-notification-controller, flux-kustomize-controller, bom, dgraph, certificate-transparency, hey, kind, aws-efs-csi-driver, minio,...

AZL-31296 CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...