109 matches found
AZL-39487 CVE-2023-45288 affecting package cri-tools for versions less than 1.29.0-2
An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...
AZL-35640 CVE-2024-24786 affecting package cri-tools for versions less than 1.30.1-1
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
AZL-35561 CVE-2024-24786 affecting package cri-tools for versions less than 1.29.0-5
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
conmon security update
conmon 2.1.3-8 - address CVE-2023-39326 cri-o 1.25.5-1 - Added Oracle Specifile Files for cri-o cri-tools 1.25.0-3 - Resolve CVE-2023-39326 flannel-cni-plugin 1.0.1-4 - Resolve CVE-2023-39326 helm 3.11.1-3 - address CVE-2023-39326 istio 1.16.7-3 - Updated Golang to 1.20.12 to address CVE...
CBL Mariner 2.0 Security Update: cri-tools / kubernetes / kubevirt / moby-runc (CVE-2024-21626M)
The version of cri-tools / kubernetes / kubevirt / moby-runc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21626M advisory. - NIST NVD Details CVE-2024-21626 Note that Nessus has not tested for...
CVE-2024-21626 affecting package cri-tools for versions less than 1.28.0-5
CVE-2024-21626 affecting package cri-tools for versions less than 1.28.0-5. A patched version of the package is available...
CBL Mariner 2.0 Security Update: cri-tools / kubernetes (CVE-2024-21626)
The version of cri-tools / kubernetes installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21626 advisory. - runc is a CLI tool for spawning and running containers on Linux according to the OCI...
Amazon Linux 2 : cri-tools (ALAS-2024-2446)
The version of cri-tools installed on the remote host is prior to 1.29.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2446 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read ma...
GHSA-XW73-RW38-6VJC vulnerabilities
Vulnerabilities for packages: cri-tools, helm-fips, policy-controller, helm, k9s, argo-workflows-fips, trivy, helm-operator-fips, ctop, cadvisor-fips, eksctl, guac, kargo, k3d, kubeflow-katib, nerdctl, flux-image-reflector-controller, falcoctl, falcoctl-fips, helm-operator,...
CVE-2024-24557 vulnerabilities
Vulnerabilities for packages: cri-tools, helm-fips, policy-controller, helm, k9s, argo-workflows-fips, trivy, helm-operator-fips, ctop, cadvisor-fips, eksctl, guac, kargo, k3d, kubeflow-katib, nerdctl, flux-image-reflector-controller, falcoctl, falcoctl-fips, helm-operator,...
AZL-34642 CVE-2024-21626 affecting package cri-tools for versions less than 1.30.1-1
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem...
AZL-34060 CVE-2024-21626 affecting package cri-tools for versions less than 1.28.0-5
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem...
conmon security update
conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...
conmon security update
conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...
olcne security update
conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build 2.1.3.3 - Add OL9 support 2.1.3.2 - Update inline with Linux team building conmon for all but OL7. cri-o...
CVE-2023-47108 vulnerabilities
Vulnerabilities for packages: envoy-ratelimit, volume-modifier-for-k8s, kubernetes-csi-external-resizer, kubescape, buildkitd, kine, metrics-server, temporal, k3s, temporal-server, docker-compose, kubernetes, kubevela, cri-tools...
Amazon Linux 2 : cri-tools (ALAS-2023-2324)
The version of cri-tools installed on the remote host is prior to 1.26.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2324 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...
Important: cri-tools
Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cri-tools Note: This advisory is applicable to Amazon...