AZL-34585 CVE-2023-6337 affecting package cert-manager for versions less than 1.12.12-1

HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of...

CVE-2023-46100 Cert manager has a use of uninitialized resource vulnerability

in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource...

CVE-2023-46100 Cert manager has a use of uninitialized resource vulnerability

in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.12.1

cert-manager Operator for Red Hat OpenShift 1.12.1 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

Important: Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.11.5

cert-manager Operator for Red Hat OpenShift 1.11.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: docker-compose, buildkitd, kubevela, metrics-server, temporal, k3s, kubescape, volume-modifier-for-k8s, kubernetes-csi-external-resizer, kine, cri-tools, kubernetes, envoy-ratelimit, temporal-server...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: falcoctl-fips, kubescape, scorecard, slsa-verifier, spire-server-fips, bom, ctop, up, k3s, tekton-chains, aactl, kpt, k3d, chartmuseum, paranoia, skaffold...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: dynamic-localpv-provisioner-fips, kubernetes-csi-livenessprobe, timestamp-authority-fips, cortex, terraform-provider-sendgrid-fips, smarter-device-manager-fips, spark-operator, falcoctl-fips, scorecard, src, kubeflow, kubernetes-csi-livenessprobe-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aactl, scorecard, src, buildkitd, terraform-provider-sendgrid, kubevela, up, kubescape, slsa-verifier, kubeflow, k3d, cortex, spark-operator, dgraph...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: rancher-webhook-fips, kubernetes-fips, buildkitd, kubernetes, kubevela, caddy, up, k3s, rancher-webhook, kube-oidc-proxy, prometheus-adapter, metrics-server-fips...

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is available...

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is available...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: buildkitd, kubevela, up, k3s, prometheus-adapter, kubernetes, caddy...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: rancher-webhook-fips, kubernetes-fips, buildkitd, kubernetes, kubevela, caddy, up, k3s, rancher-webhook, kube-oidc-proxy, prometheus-adapter, metrics-server-fips...

AZL-34588 CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

AZL-31639 CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: atlantis-fips, node-problem-detector, nodetaint, metacontroller, nats, prometheus-mysqld-exporter, gobuster, dex, prometheus-adapter, runc, crossplane-provider-aws, cosign, git-lfs, flux-kustomize-controller, pulumi, terraform-provider-sendgrid, skaffold,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: nri-prometheus, stakater-reloader, spark-operator, prometheus-adapter, cortex, pulumi-kubernetes-operator, nats, hugo, terraform-provider-aws, flux-kustomize-controller, aactl, nginx-mainline, minio, pulumi-language-yaml, kind, haproxy-ingress, pulumi, k3d, dex,...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: nri-prometheus, stakater-reloader, spark-operator, prometheus-adapter, cortex, pulumi-kubernetes-operator, nats, hugo, terraform-provider-aws, flux-kustomize-controller, aactl, nginx-mainline, minio, pulumi-language-yaml, kind, haproxy-ingress, pulumi, k3d, dex,...

AZL-31296 CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...