Spring Cloud Config Server May Not Use Vault Token Sent By Clients

Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affected by this if the following are true: In this case the SessionManager persists the first token it retrieves and will continue to use that...

Improper Authorization

Overview org.springframework.cloud:spring-cloud-config-server is a library that provides an HTTP resource-based API for external configuration. Affected versions of this package are vulnerable to Improper Authorization due to not using the Vault token sent by clients using a X-CONFIG-TOKEN header...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +328 more potentially affected by CVE-2024-22257 via org.springframework.security:spring-security-core (4.2.5.release)

org.springframework.security:spring-security-core MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

cn.home1:spring-cloud-config-monitor (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1) +326 more potentially affected by CVE-2023-34055 via org.springframework.boot:spring-boot-actuator (1.5.12.release)

org.springframework.boot:spring-boot-actuator MAVEN version 1.5.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.boot:spring-boot-actuator and may be impacted: - cn.home1:spring-cloud-config-monitor =0.0.1, =0.0.1, =0.0.1,...

Security Bypass With Wildcard Pattern Matching on Cloud Foundry

In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, an application that is deployed to Cloud Foundry could be susceptible to a security bypass. Specifically, an application is vulnerable when all of the following are true: NOTE:...

Malicious code in node-config-server-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26a77c066606c4a4a84afcd49a13b450d6d65f2d7f351ff6d37d75743c5e1792 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +183 more potentially affected by CVE-2021-3629 via io.undertow:undertow-core (1.4.23.final)

io.undertow:undertow-core MAVEN version 1.4.23.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1, =0.0.1, =5.1.0, =1.5.12, =1.5.12, =1.5.16, =1.5.12...

cn.home1:spring-cloud-config-monitor (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1) +552 more potentially affected by CVE-2016-1000027 via org.springframework:spring-web (4.3.16.release)

org.springframework:spring-web MAVEN version 4.3.16.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - cn.home1:spring-cloud-config-monitor =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.0.1.releas...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +90 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-web (4.2.5.release)

org.springframework.security:spring-security-web MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

cn.home1:spring-cloud-config-server (>=0.0.1, <=1.0.1.u1), cn.home1:spring-cloud-eureka-server (>=0.0.1, <=1.0.1.u1) +328 more potentially affected by CVE-2022-22978 via org.springframework.security:spring-security-core (4.2.5.release)

org.springframework.security:spring-security-core MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-core and may be impacted: - cn.home1:spring-cloud-config-server =0.0.1, =0.0.1,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

Design/Logic Flaw

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

CVE-2021-20238 affects OpenShift Container Platform 4 where the ignition config served by the Machine Config Server can be accessed externally (port 22623, the MCS endpoint) without authentication. This exposes ignition data used to bootstrap nodes (e.g., registry pull secrets) in two scenarios: ...

Red Hat OpenShift Container Platform 访问控制错误漏洞

Red Hat OpenShift Container Platform is a suite of application platforms from Red Hat, Inc. that enable organizations to develop, deploy, and manage existing container-based applications across physical, virtual, and public cloud infrastructures. An access control error vulnerability exists in...

CVE-2021-20238: Improper Authentication

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

PT-2022-9172 · Red Hat · Openshift Container Platform 4

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform 4 affected versions not specified Description: It was found that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623...

spring-cloud-config-server: sending a request using a specially crafted URL can lead to a directory traversal attack

A flaw was found in spring-cloud-config in versions prior to 2.1.9 and 2.2.3. Applications are allowed to serve arbitrary configuration files through the spring-cloud-config-server module allowing an attacker to send a request using a specially crafted URL to create a directory traversal attack...