CSAF - Cyber Security Awareness Framework

The Cyber Security Awareness Framework CSAF is a structured approach aimed at enhancing Cybersecurity" title="Cybersecurity"cybersecurity awareness and understanding among individuals, organizations, and communities. It provides guidance for the development of effective Cybersecurity"...

OESA-2024-1466 docker security update

Docker is an open source project to build, ship and run any application as a lightweight container. Security Fixes: Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking...

CVE-2024-32473

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. In 26.0.0, IPv6 is not disabled on network interfaces, including those belonging to networks where --ipv6=false. An container with an ipvl...

CVE-2024-32473

CVE-2024-32473 affects Moby (Docker Engine/related tooling). In 26.0.0 IPv6 was not disabled on interfaces, including those with --ipv6=false, allowing containers with ipvlan/macvlan to access local networks via IPv6, potentially receive SLAAC addresses, or join IPv6 multicast groups, increasing ...

AZL-39325 CVE-2023-45288 affecting package moby-compose for versions less than 2.17.3-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-38569 CVE-2023-45288 affecting package docker-compose for versions less than 2.27.0-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

Exploit for Use After Free in Linux Linux_Kernel

https://github.com/Notselwyn/CVE-2024-1086 usage docker...

CVE-2024-29018

Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. Moby's networking implementation allows for many networks, each with their own IP address range and gateway, to be defined. This feature i...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: zot, cilium-cli, conftest, buildkitd, kargo, spire-server-fips, syft, melange, kubescape, buf, kaniko, cadvisor-fips, spire-server, crossplane, tkn, grype, ctop, docker-compose, ko, dagger, prometheus, loki, conftest-fips, wolfictl, trivy, aactl, cadvisor, up...

Bootiful Spring Boot in 2024 (part 1)

NB: the code is here on my Github account: github.com/joshlong/bootiful-spring-boot-2024-blog. Hi, Spring fans! I'm Josh Long, and I work on the Spring team. I'm excited to be keynoting and giving a talk at Microsoft's JDConf this year. I'm a Kotlin GDE and a Java Champion, and I'm of the opinion...

AZL-35643 CVE-2024-24786 affecting package docker-compose for versions less than 2.27.0-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: node-problem-detector, mc-fips, external-dns, buildkitd, boring-registry-fips, pulumi-language-java, kor, metallb, policy-controller, cri-tools, crossplane-provider-azure-sql, velero, prometheus-pushgateway-fips, grafana-operator, conftest-fips, nodetaint,...

AZL-35583 CVE-2024-24786 affecting package moby-compose for versions less than 2.17.3-5

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

Header Injection

org.apache.james: apache-mime4j-core is vulnerable to Header Injection. The vulnerability is due to improper input validation when using MIME4J DOM to compose messages, which allows an attacker to add unintended headers to MIME messages...

AZL-35439 CVE-2024-23653 affecting package docker-compose for versions less than 2.27.0-1

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...

AZL-34081 CVE-2024-23653 affecting package moby-compose for versions less than 2.17.2-7

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...

AZL-35438 CVE-2024-23650 affecting package docker-compose for versions less than 2.27.0-1

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

AZL-34080 CVE-2024-23650 affecting package moby-compose for versions less than 2.17.3-5

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been fixed in v0.12.5. As a workaround, avoi...

This Week in Spring - January 23rd, 2024

Hi, Spring fans, and greetings from CERN, home of the famous Large Hadron Collider, where I'm speaking again at the VOXXED Days CERN 2017 event. It's been an amazing almost week here in lovely Switzerland, first in Lugano for VOXXED Days Ticino, and now in Geneva. I'm super excited to be here, bu...

AZL-32224 CVE-2023-48795 affecting package moby-compose for versions less than 2.17.3-5

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...