142 matches found
Medium: cni-plugins
Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...
Important: cni-plugins
Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...
Important: cni-plugins
Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...
Amazon Linux 2 : cni-plugins (ALAS-2025-2882)
The version of cni-plugins installed on the remote host is prior to 1.7.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2882 advisory. The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare...
Important: cni-plugins
Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...
Important: cni-plugins
Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...
CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3
CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3. A patched version of the package is available...
CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8
CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8. A patched version of the package is available...
AZL-60447 CVE-2025-22872 affecting package cni-plugins for versions less than 1.4.0-3
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
AZL-60502 CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
GHSA-FGQ5-Q76C-GX78 vulnerabilities
Vulnerabilities for packages: envoy-ratelimit, rabbitmq-cluster-operator, kustomize, grpcurl, kubevela, vault-k8s, memcached-exporter, kubernetes-dashboard, supercronic, grype, flux-helm-controller, ytt, helm-operator, delve, rqlite, ferretdb, kubernetes-csi-external-resizer,...
GHSA-8XFX-RJ4P-23JM vulnerabilities
Vulnerabilities for packages: victoriametrics-operator-fips, buf, secrets-store-csi-driver-provider-azure, step-issuer, kind, aws-load-balancer-controller-fips, fq, fluent-operator-fips, prometheus-beat-exporter-fips, speedtest-go, prometheus-operator, karpenter, crossplane-provider-aws-sns,...
GHSA-J7VJ-RW65-4V26 vulnerabilities
Vulnerabilities for packages: victoriametrics-operator-fips, buf, secrets-store-csi-driver-provider-azure, step-issuer, kind, aws-load-balancer-controller-fips, fq, fluent-operator-fips, prometheus-beat-exporter-fips, speedtest-go, prometheus-operator, karpenter, crossplane-provider-aws-sns,...
GHSA-3F6R-QH9C-X6MM vulnerabilities
Vulnerabilities for packages: victoriametrics-operator-fips, argo-events, secrets-store-csi-driver-provider-azure, kind, aws-load-balancer-controller-fips, fq, fluent-operator-fips, prometheus-beat-exporter-fips, consul-k8s-fips, prometheus-operator, karpenter, speedtest-go, yq-fips, ctop,...
Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins (CVE-2024-45338)
The version of application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45338 advisory. - An attacker can craft an input t...
CVE-2024-45338 affecting package cni-plugins for versions less than 1.4.0-2
CVE-2024-45338 affecting package cni-plugins for versions less than 1.4.0-2. A patched version of the package is available...
CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7
CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7. A patched version of the package is available...
CBL Mariner 2.0 Security Update: application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins (CVE-2024-45338)
The version of application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45338 advisory. - An attacker can craft an input t...
AZL-54542 CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...