Moderate: Red Hat Enhancement Advisory: Red Hat OpenShift Pipelines Operator Bundle 1.15.0 release

Red Hat OpenShift Pipelines 1.15.0 has been released. Red Hat OpenShift Pipelines is a cloud-native continuous integration and delivery CI/CD solution for building pipelines using Tekton. Tekton is a flexible, Kubernetes-native, open-source CI/CD framework which enables automating deployments...

CVE-2024-35900

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject new basechain after table flag update When dormant flag is toggled, hooks are disabled in the commit phase by iterating over current chains in table existing and new. The following configuration allows...

CVE-2024-34075

kurwov is a fast, dependency-free library for creating Markov Chains. An unsafe sanitization of dataset contents on the MarkovDatagetNext method used in Markovgenerate and Markovchoose allows a maliciously crafted string on the dataset to throw and stop the function from running properly. If a...

CVE-2024-34075 kurwov vulnerable to Denial of Service due to improper data sanitization

kurwov is a fast, dependency-free library for creating Markov Chains. An unsafe sanitization of dataset contents on the MarkovDatagetNext method used in Markovgenerate and Markovchoose allows a maliciously crafted string on the dataset to throw and stop the function from running properly. If a...

CVE-2024-34075

CVE-2024-34075 (kurwov) affects the Markov chain library kurwov. A flaw in the unsafe sanitization in MarkovData#getNext (used by Markov#generate and Markov#choose) lets a crafted dataset string bypass sanitization when it contains the forbidden substring "proto " followed by a space, by manipula...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: goreleaser, zot, tkn, aactl, spire-server, policy-controller-fips, flux-source-controller, slsa-verifier, zarf, apko, ko-fips, chainctl, kubescape, falcoctl-fips, skaffold, spire-server-fips, melange, tekton-chains, policy-controller, falcoctl, tkn-fips, wolfictl,...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: flux-source-controller, falcoctl, neuvector-sigstore-interface, ko, slsa-verifier, wolfictl, aactl, apko, zot, vexctl, zarf, tkn, policy-controller, kubescape, melange, tekton-chains, goreleaser, gitsign, spire-server, skaffold...

GHSA-88JX-383Q-W4QC vulnerabilities

Vulnerabilities for packages: flux-source-controller, falcoctl, neuvector-sigstore-interface, ko, slsa-verifier, wolfictl, aactl, apko, zot, vexctl, zarf, tkn, policy-controller, kubescape, melange, tekton-chains, goreleaser, gitsign, spire-server, skaffold...

CVE-2024-29903 vulnerabilities

Vulnerabilities for packages: flux-source-controller, falcoctl, neuvector-sigstore-interface, ko, slsa-verifier, wolfictl, aactl, apko, zot, vexctl, zarf, tkn, policy-controller, kubescape, melange, tekton-chains, goreleaser, gitsign, spire-server, skaffold...

CVE-2024-29903 vulnerabilities

Vulnerabilities for packages: goreleaser, zot, tkn, aactl, spire-server, policy-controller-fips, flux-source-controller, slsa-verifier, zarf, apko, ko-fips, chainctl, kubescape, falcoctl-fips, skaffold, spire-server-fips, melange, tekton-chains, policy-controller, falcoctl, tkn-fips, wolfictl,...

CVE-2024-29902 vulnerabilities

Vulnerabilities for packages: flux-source-controller, falcoctl, neuvector-sigstore-interface, ko, slsa-verifier, wolfictl, aactl, apko, zot, vexctl, zarf, tkn, policy-controller, kubescape, melange, tekton-chains, goreleaser, gitsign, spire-server, skaffold...

CVE-2024-29902 vulnerabilities

Vulnerabilities for packages: goreleaser, zot, tkn, aactl, spire-server, policy-controller-fips, flux-source-controller, slsa-verifier, zarf, apko, ko-fips, chainctl, kubescape, falcoctl-fips, skaffold, spire-server-fips, melange, tekton-chains, policy-controller, falcoctl, tkn-fips, wolfictl,...

CVE-2024-31995 zcap has incomplete expiration checks in capability chains.

@digitalbazaar/zcap provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires property is not properly checked against the current da...

CVE-2024-31995 zcap has incomplete expiration checks in capability chains.

@digitalbazaar/zcap provides JavaScript reference implementation for Authorization Capabilities. Prior to version 9.0.1, when invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires property is not properly checked against the current da...

GHSA-HP8H-7X69-4WMV zcap has incomplete expiration checks in capability chains.

Impact When invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires property is not properly checked against the current date or other date param. This can allow invocations outside of the original intended time period. A zcap still cann...

zcap has incomplete expiration checks in capability chains.

Impact When invoking a capability with a chain depth of 2, i.e., it is delegated directly from the root capability, the expires property is not properly checked against the current date or other date param. This can allow invocations outside of the original intended time period. A zcap still cann...

Deserialization of Untrusted Data in timber/timber

Summary Timber is vulnerable to PHAR deserialization due to a lack of checking the input before passing it into the fileexists function. If an attacker can upload files of any type to the server, he can pass in the phar:// protocol to unserialize the uploaded file and instantiate arbitrary PHP...

SUSE-SU-2024:1179-1 Security update for gnutls

This update for gnutls fixes the following issues: Security issues fixed: - CVE-2023-0361: Fixed a Bleichenbacher oracle in the TLS RSA key exchange bsc1208143. - CVE-2023-5981: Fixed timing side-channel inside RSA-PSK key exchange bsc1217277. - CVE-2024-0567: Fixed an incorrect rejection of...

Denial Of Service

go is vulnerable to Denial Of Service. The vulnerability is due to insufficient handling of certificate chains containing certificates with unknown public key algorithms...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: rabbitmq-messaging-topology-operator, rekor, step, flux-source-controller, falcoctl, cosign, ko, step-ca, gomplate, grpc-health-probe, slsa-verifier, wolfictl, aactl, kube-rbac-proxy, argo-workflows, dgraph, apko, oauth2-proxy, zot, caddy, rook, vexctl, zarf, tkn,...