AZL-35640 CVE-2024-24786 affecting package cri-tools for versions less than 1.30.1-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35561 CVE-2024-24786 affecting package cri-tools for versions less than 1.29.0-5

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

conmon security update

conmon 2.1.3-8 - address CVE-2023-39326 cri-o 1.25.5-1 - Added Oracle Specifile Files for cri-o cri-tools 1.25.0-3 - Resolve CVE-2023-39326 flannel-cni-plugin 1.0.1-4 - Resolve CVE-2023-39326 helm 3.11.1-3 - address CVE-2023-39326 istio 1.16.7-3 - Updated Golang to 1.20.12 to address CVE...

CBL Mariner 2.0 Security Update: cri-tools / kubernetes / kubevirt / moby-runc (CVE-2024-21626M)

The version of cri-tools / kubernetes / kubevirt / moby-runc installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21626M advisory. - NIST NVD Details CVE-2024-21626 Note that Nessus has not tested for...

CVE-2024-21626 affecting package cri-tools for versions less than 1.28.0-5

CVE-2024-21626 affecting package cri-tools for versions less than 1.28.0-5. A patched version of the package is available...

CBL Mariner 2.0 Security Update: cri-tools / kubernetes (CVE-2024-21626)

The version of cri-tools / kubernetes installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21626 advisory. - runc is a CLI tool for spawning and running containers on Linux according to the OCI...

Amazon Linux 2 : cri-tools (ALAS-2024-2446)

The version of cri-tools installed on the remote host is prior to 1.29.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2446 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read ma...

GHSA-XW73-RW38-6VJC vulnerabilities

Vulnerabilities for packages: skaffold, cadvisor-fips, cri-tools, flux-image-reflector-controller, kpt, k9s, pulumi, dagger, flux-helm-controller, aactl, docker-credential-gcr, helm, kubeflow-katib, ko-fips, rancher-machine, gitsign, kargo, kots, policy-controller, scorecard, skopeo, falcoctl-fip...

CVE-2024-24557 vulnerabilities

Vulnerabilities for packages: skaffold, cadvisor-fips, cri-tools, flux-image-reflector-controller, kpt, k9s, pulumi, dagger, flux-helm-controller, aactl, docker-credential-gcr, helm, kubeflow-katib, ko-fips, rancher-machine, gitsign, kargo, kots, policy-controller, scorecard, skopeo, falcoctl-fip...

AZL-34642 CVE-2024-21626 affecting package cri-tools for versions less than 1.30.1-1

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem...

AZL-34060 CVE-2024-21626 affecting package cri-tools for versions less than 1.28.0-5

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process from runc exec to have a working directory in the host filesystem...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

olcne security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build 2.1.3.3 - Add OL9 support 2.1.3.2 - Update inline with Linux team building conmon for all but OL7. cri-o...

CVE-2023-47108 vulnerabilities

Vulnerabilities for packages: docker-compose, k3s, kubernetes, kubescape, envoy-ratelimit, volume-modifier-for-k8s, kine, temporal-server, kubernetes-csi-external-resizer, temporal, metrics-server, kubevela, buildkitd, cri-tools...

Amazon Linux 2 : cri-tools (ALAS-2023-2324)

The version of cri-tools installed on the remote host is prior to 1.26.1-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2324 advisory. The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams...

Important: cri-tools

Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Affected Packages: cri-tools Note: This advisory is applicable to Amazon...

CVE-2023-44487 affecting package cri-tools for versions less than 1.28.0-2

CVE-2023-44487 affecting package cri-tools for versions less than 1.28.0-2. A patched version of the package is available...

CVE-2023-39325 affecting package cri-tools for versions less than 1.28.0-2

CVE-2023-39325 affecting package cri-tools for versions less than 1.28.0-2. A patched version of the package is available...

AZL-31609 CVE-2023-39325 affecting package cri-tools for versions less than 1.28.0-2

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...