PT-2025-39386

Name of the Vulnerable Software and Affected Versions Project Gardener versions prior to 1.64.0 AWS providers Project Gardener versions prior to 1.55.0 Azure providers Project Gardener versions prior to 1.49.0 OpenStack providers Project Gardener versions prior to 1.46.0 GCP providers Description...

Gardener Extension for AWS provider 代码注入漏洞

Gardener Extension for AWS provider is an =extension controller= for Gardener open source. A code injection vulnerability exists in Gardener Extension for AWS provider, which stems from a vulnerability that could allow a user with administrative privileges to gain control of a seeded cluster via...

CVE-2025-47910 vulnerabilities

Vulnerabilities for packages: nova, migrate, docker-credential-gcr, zot, bom, falcoctl, wgcf, cloud-sql-proxy, kor, grafana-alloy, rancher-system-upgrade-controller, delve, terraform-mcp-server, emissary, nuclei, spire-controller-manager, nri-memcached, steampipe, trivy, gobump,...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: nova, migrate, docker-credential-gcr, zot, bom, falcoctl, wgcf, cloud-sql-proxy, kor, grafana-alloy, rancher-system-upgrade-controller, delve, terraform-mcp-server, emissary, nuclei, spire-controller-manager, nri-memcached, steampipe, trivy, gobump,...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: aws-privateca-issuer, cluster-api, kapp, nri-memcached, teleport, dragonfly-operator, kuberlr, falcoctl, rancher-system-upgrade-controller, regclient, polaris, portieris, witness, contour, karpenter, ratify, tekton-pipelines, blob-csi, neuvector-sigstore-interface,...

GHSA-2HMJ-97JW-28JH Apache ZooKeeper: Insufficient Permission Check in AdminServer Snapshot/Restore Commands

Improper permission checks in the AdminServer allow an authenticated client with insufficient privileges to invoke the snapshot and restore commands. The intended requirement is authentication and authorization on the root path / with ALL permission for these operations; however, affected version...

SUSE CVE-2025-39885

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on a FSIOCFIEMAP of the extent list on a specially crafted mmap file. contextswitch kernel/sched/core.c:5357 inline...

UBUNTU-CVE-2025-39885

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on a FSIOCFIEMAP of the extent list on a specially crafted mmap file. contextswitch kernel/sched/core.c:5357 inline...

CVE-2025-39885 ocfs2: fix recursive semaphore deadlock in fiemap call

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on a FSIOCFIEMAP of the extent list on a specially crafted mmap file. contextswitch kernel/sched/core.c:5357 inline...

PT-2025-44123

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the ocfs2 component related to a double free in the user cluster connect function. Specifically, user cluster disconnect frees a memory region, an...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a recursive semaphore deadlock in the OCFS2 file system, which could lead to a file system hang...

Privilege Escalation

Kubernetes is vulnerable to Privilege Escalation. The vulnerability is due to improper access control because node users can patch their node object with an OwnerReference to a cluster-scoped resource, leading to unintended node deletion via garbage collection...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.1, cluster-api, mattmoor-chainit, kubernetes-dashboard-fips, terraform-provider-tls-fips, prometheus-process-exporter, prometheus-node-exporter-fips, karpenter, octo-sts, custom-pod-autoscaler-operator, stakater-reloader, kuberay-operator,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: nvidia-nsight-compute-13.1, cluster-api, mattmoor-chainit, kubernetes-dashboard-fips, terraform-provider-tls-fips, prometheus-process-exporter, prometheus-node-exporter-fips, karpenter, octo-sts, custom-pod-autoscaler-operator, stakater-reloader, kuberay-operator,...

SUSE CVE-2025-39842

In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2deleteosb, ocfs2journalshutdown has already been executed in ocfs2dismountvolume, so osb-journal must be NULL. Therefore, the following calltrace wil...

SUSE CVE-2025-59358

The Chaos Controller Manager in Chaos Mesh exposes a GraphQL debugging server without authentication to the entire Kubernetes cluster, which provides an API to kill arbitrary processes in any Kubernetes pod, leading to cluster-wide denial of service...

SUSE CVE-2025-59360

The killProcesses mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

SUSE CVE-2025-59361

The cleanIptables mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthenticated in-cluster attackers to perform remote code execution across the cluster...

UBUNTU-CVE-2025-39842

In the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2deleteosb, ocfs2journalshutdown has already been executed in ocfs2dismountvolume, so osb-journal must be NULL. Therefore, the following calltrace wil...

CVE-2025-39842

CVE-2025-39842 : In the Linux kernel, the ocfs2 path could dereference a NULL journal pointer when releasing an inode during journal shutdown. The root cause was calling jbd2_journal_release_jbd_inode() with osb->journal potentially NULL after ocfs2_journal_shutdown(). The fix is to add explic...