AZL-60502 CVE-2025-22872 affecting package cni-plugins for versions less than 1.3.0-8

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: logstash-exporter, node-problem-detector, yam, prometheus-adapter, thanos-operator, clusterctl, chartmuseum, rqlite, nri-f5, go-md2man, newrelic-infrastructure-agent, gops, gomplate, crossplane-provider-azure, gosu, wireguard-go, flux-image-automation-controller,...

GHSA-J7VJ-RW65-4V26 vulnerabilities

Vulnerabilities for packages: go-msft, whereabouts-fips, istio-operator, aws-flb-kinesis, cadvisor-fips, loki, gatekeeper-fips, minio-operator-fips, boring-registry, volume-modifier-for-k8s-fips, crossplane-provider-aws-ec2, helm-push, crossplane-provider-aws-cloudformation, trino,...

GHSA-8XFX-RJ4P-23JM vulnerabilities

Vulnerabilities for packages: go-msft, whereabouts-fips, istio-operator, aws-flb-kinesis, cadvisor-fips, loki, gatekeeper-fips, minio-operator-fips, boring-registry, volume-modifier-for-k8s-fips, crossplane-provider-aws-ec2, helm-push, crossplane-provider-aws-cloudformation, trino,...

GHSA-3F6R-QH9C-X6MM vulnerabilities

Vulnerabilities for packages: go-msft, whereabouts-fips, istio-operator, aws-flb-kinesis, cadvisor-fips, sftpgo-plugin-pubsub, loki, amazon-cloudwatch-agent-fips, docker-credential-acr-env-fips, grafana-rollout-operator-fips, boring-registry, kapp-controller-fips, beats-fips,...

Azure Linux 3.0 Security Update: application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins (CVE-2024-45338)

The version of application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45338 advisory. - An attacker can craft an input t...

CVE-2024-45338 affecting package cni-plugins for versions less than 1.4.0-2

CVE-2024-45338 affecting package cni-plugins for versions less than 1.4.0-2. A patched version of the package is available...

CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7

CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7. A patched version of the package is available...

CBL Mariner 2.0 Security Update: application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins (CVE-2024-45338)

The version of application-gateway-kubernetes-ingress / cert-manager / cf-cli / cni / cni-plugins installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-45338 advisory. - An attacker can craft an input t...

AZL-54542 CVE-2024-45338 affecting package cni-plugins for versions less than 1.3.0-7

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2023-3978 affecting package cni-plugins for versions less than 1.3.0-6

CVE-2023-3978 affecting package cni-plugins for versions less than 1.3.0-6. A patched version of the package is available...

ALSA-2024:8110 Important: containernetworking-plugins security update

The Container Network Interface CNI project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated...

SUSE-SU-2024:2422-1 Security update for cni-plugins

This update of cni-plugins fixes the following issues: - rebuild the package with the go 1.21 security release bsc1212475...

PT-2024-40999 · Unknown · Cni-Plugins

Name of the Vulnerable Software and Affected Versions: cni-plugins affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the go 1.21 security release. Recommendations: At the moment, there is no information about a newer...

OPENSUSE-SU-2024:12513-1 cni-plugins-1.1.1-2.1 on GA media

These are all security issues fixed in the cni-plugins-1.1.1-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:10689-1 cni-plugins-0.9.1-1.3 on GA media

These are all security issues fixed in the cni-plugins-0.9.1-1.3 package on the GA media of openSUSE Tumbleweed...

CVE-2024-24789 vulnerabilities

Vulnerabilities for packages: istio-operator, aws-flb-kinesis, cadvisor-fips, loki, boring-registry, helm-push, kuberay-operator, src-fingerprint, thanos-operator-fips, skaffold, velero-plugin-for-csi-fips, tfsec, configmap-reload-fips, cass-operator-fips-no-pvc-delete,...

Amazon Linux 2 : cni-plugins (ALAS-2024-2555)

The version of cni-plugins installed on the remote host is prior to 1.2.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2555 advisory. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATIO...

Medium: cni-plugins

Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...

Medium: cni-plugins

Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...