AZL-34585 CVE-2023-6337 affecting package cert-manager for versions less than 1.12.12-1

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of...

CVE-2023-46100 Cert manager has a use of uninitialized resource vulnerability

in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource...

CVE-2023-46100 Cert manager has a use of uninitialized resource vulnerability

in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.12.1

cert-manager Operator for Red Hat OpenShift 1.12.1 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.11.5

cert-manager Operator for Red Hat OpenShift 1.11.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: cri-tools, kubescape, docker-compose, temporal-server, k3s, buildkitd, kubernetes, kubevela, temporal, envoy-ratelimit, kubernetes-csi-external-resizer, volume-modifier-for-k8s, kine, metrics-server...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: tekton-chains, falcoctl-fips, slsa-verifier, kpt, spire-server-fips, k3d, scorecard, skaffold, chartmuseum, up, aactl, ctop, k3s, kubescape, bom, paranoia...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: plutono-fips, kubevela, aactl, kubernetes-csi-livenessprobe, kubeflow-fips, prometheus-stackdriver-exporter, scorecard, dgraph, src, terraform-provider-sendgrid-fips, up, kubescape, kiam, falcoctl-fips, smarter-device-manager-fips, vault-csi-provider,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: slsa-verifier, scorecard, spark-operator, kubescape, buildkitd, kubevela, up, kubeflow, dgraph, cortex, aactl, src, k3d, terraform-provider-sendgrid...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, rancher-webhook-fips, metrics-server-fips, kubevela, rancher-webhook, kubernetes, up, caddy, prometheus-adapter, k3s, kubernetes-fips, buildkitd...

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is available...

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is available...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: caddy, k3s, buildkitd, kubevela, kubernetes, up, prometheus-adapter...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, rancher-webhook-fips, metrics-server-fips, kubevela, rancher-webhook, kubernetes, up, caddy, prometheus-adapter, k3s, kubernetes-fips, buildkitd...

AZL-31639 CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: flux-source-controller, k8sgpt-operator, terraform, kpt, minio, apko, frp, metacontroller, caddy, gke-gcloud-auth-plugin, kind, kubernetes-ingress-defaultbackend, prometheus-stackdriver-exporter, dgraph, src, falcoctl, flux-helm-controller, bom, aws-efs-csi-driver,...

AZL-34588 CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: spark-operator, kots, gomplate, hugo, flux-notification-controller, src, k3d, rqlite, flux-kustomize-controller, hey, skaffold, terraform, pulumi, fuse-overlayfs-snapshotter, kubeflow, ko, prometheus-adapter, atlantis, secrets-store-csi-driver, cortex, aactl,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: spark-operator, kots, gomplate, hugo, flux-notification-controller, src, k3d, rqlite, flux-kustomize-controller, hey, skaffold, terraform, pulumi, fuse-overlayfs-snapshotter, kubeflow, ko, prometheus-adapter, atlantis, secrets-store-csi-driver, cortex, aactl,...

AZL-31296 CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...