GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, memcached-exporter, kind, k3d, spark-operator, kubernetes-csi-livenessprobe, haproxy-ingress, newrelic-infrastructure-agent, flux-notification-controller, bom, ip-masq-agent, buildkitd, fuse-overlayfs-snapshotter, kubeflow, grpcurl, oauth2-proxy,...

AZL-35284 CVE-2022-41717 affecting package sriov-network-device-plugin for versions less than 3.7.0-1

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate...

AZL-33643 CVE-2022-32149 affecting package sriov-network-device-plugin for versions less than 3.6.2-2

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...

AZL-35283 CVE-2022-29526 affecting package sriov-network-device-plugin for versions less than 3.7.0-1

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible...