Security Bulletin: Multiple vulnerabilities in golang affect IBM Db2® REST

Summary IBM Db2® REST is affected by multiple vulnerabilities found in Golang. IBM has addressed the vulnerabilities. Vulnerability Details CVEID:CVE-2023-24540 DESCRIPTION: Go is vulnerable to HTML injection. A remote attacker could inject malicious HTML code into a template containing whitespac...

Design/Logic Flaw

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry and added a high number of signatures to an artifact can cause denial of service of services on the machine, if a user runs notation verify command on the same machine. The...

CVE-2023-33959 Verification bypass can cause users into verifying the wrong artifact

notation is a CLI tool to sign and verify OCI artifacts and container images. An attacker who has compromised a registry can cause users to verify the wrong artifact. The problem has been fixed in the release v1.0.0-rc.6. Users should upgrade their notation-go library to v1.0.0-rc.6 or above. Use...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® REST

Summary IBM has released the below fix for IBM Db2® REST in response to multiple vulnerabilities found in Golang Vulnerability Details CVEID:CVE-2022-41717 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by a flaw when handling HTTP/2 requests in the Go server. By sending a...

SUSE CVE-2022-23649

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

SUSE CVE-2023-24827

syft is a a CLI tool and Go library for generating a Software Bill of Materials SBOM from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFTATTESTPASSWORD environment variable. The...

Researchers Disclose Supply-Chain Flaw Affecting IBM Cloud Databases for PostgreSQL

IBM has fixed a high-severity security vulnerability affecting its Cloud Databases ICD for PostgreSQL product that could be potentially exploited to tamper with internal repositories and run unauthorized code. The privilege escalation flaw CVSS score: 8.8, dubbed "Hell's Keychain" by cloud securi...

Important: Red Hat Security Advisory: openssl-container security update

An update for openssl-container is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

[SECURITY] Fedora 36 Update: golang-github-google-containerregistry-0.5.1-6.fc36

Go library and CLIs for working with container registries...

GitLab 授权问题漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. An authorization issue vulnerability exists in GitLab EE versions 10.7 through...

Malicious code in amazon-ecr-data-replication-hub-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a32deab8300fe35db0ea930f79cccefb774d8da37e8bb3cd231a3658cd492189 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5279 Malicious code in perf-container-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34e95c6305a851bce38550d3f47bdc1fe859d9a0eceee2a062630f50d9e374d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-container-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34e95c6305a851bce38550d3f47bdc1fe859d9a0eceee2a062630f50d9e374d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in container-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbb8bfd0585a2de4feaea57d85982fffab845306bda709ed613e0c418502a532 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2169 Malicious code in container-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbb8bfd0585a2de4feaea57d85982fffab845306bda709ed613e0c418502a532 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @azure-tests/perf-container-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f758045b88d1bd05ec5e3c0cdb450944181f11fbf62924a6357d143e1641ebf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1310 Malicious code in azure-container-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e18583a9f72e6ace89831ca7a9d360678b8dec69cbd05f05408fda5941e06992 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-container-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e18583a9f72e6ace89831ca7a9d360678b8dec69cbd05f05408fda5941e06992 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1311 Malicious code in azure-container-registry-samples-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c820a88f96c37f80c1cd31ff7a8e16c0569322dff2c335469633c7614fcad195 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-container-registry-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bef553c368f9ac9f7c664a2c978dce89988d424608b5f5b47010261ee7a9ee9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...