96 matches found
CVE-2025-47911 affecting package cri-tools for versions less than 1.29.0-9
CVE-2025-47911 affecting package cri-tools for versions less than 1.29.0-9. A patched version of the package is available...
AZL-76919 CVE-2025-58190 affecting package cri-tools 1.32.0-3
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76851 CVE-2025-58190 affecting package cri-tools for versions less than 1.29.0-9
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76916 CVE-2025-47911 affecting package cri-tools 1.32.0-3
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
AZL-76848 CVE-2025-47911 affecting package cri-tools for versions less than 1.29.0-9
The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...
Amazon Linux 2 : cri-tools, --advisory ALAS2-2026-3135 (ALAS-2026-3135)
The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3135 advisory. net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary Z...
Medium: cri-tools
Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...
Amazon Linux 2 : cri-tools, --advisory ALAS2-2025-3097 (ALAS-2025-3097)
The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3097 advisory. crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a...
Medium: cri-tools
Issue Overview: crypto/x509: excluded subdomain constraint does not restrict wildcard SANs An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not...
Amazon Linux 2 : cri-tools, --advisory ALAS2-2025-3079 (ALAS-2025-3079)
The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3079 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6...
Fedora: Security Advisory (FEDORA-2025-daf52aa6ad)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-22872 affecting package cri-tools for versions less than 1.29.0-8
CVE-2025-22872 affecting package cri-tools for versions less than 1.29.0-8. A patched version of the package is available...
CVE-2025-22872 affecting package cri-tools for versions less than 1.32.0-2
CVE-2025-22872 affecting package cri-tools for versions less than 1.32.0-2. A patched version of the package is available...
GHSA-J5PM-7495-QMR3 vulnerabilities
Vulnerabilities for packages: kyverno, aws-sigv4-proxy, telegraf, amazon-k8s-cni, grype-db, pguser, flux-kustomize-controller-fips, kubernetes-replicator-fips, glab, verticadb-operator, cosign, cluster-api-azure-controller, helm-fips, snyk-cli, grafana-fips, gotestsum, blob-csi-fips, gitea, step,...
Important: cri-tools
Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...
Amazon Linux 2 : cri-tools (ALAS-2025-2870)
The version of cri-tools installed on the remote host is prior to 1.32.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-2870 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning...
Important: cri-tools
Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 The net/http package accepted data in the chunked transfer encoding...
AZL-60459 CVE-2025-22872 affecting package cri-tools for versions less than 1.32.0-2
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
AZL-60586 CVE-2025-22872 affecting package cri-tools for versions less than 1.29.0-8
The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...
