GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-azure, nri-mysql, etcd, metallb, cni-plugins-fips, go-bindata, k3d, kubeflow-pipelines, pulumi-language-java, hello-world-golang, argo-workflows-fips, volume-modifier-for-k8s, govulncheck, kubevela, logstash-exporter, nri-nginx,...

Malicious code in pulumi-eks-hello-world (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-863 Malicious code in pulumi-eks-hello-world (npm)

--- -= Per source details. Do not edit below this line.=-...

GHSA-PX8V-PP82-RCVR vulnerabilities

Vulnerabilities for packages: traefik-fips, cloudflared, traefik, caddy, eks-distro-fips, q, spegel, frp, buf, kubernetes-dns-node-cache-fips, eks-distro, kubernetes-dns-node-cache, caddy-fips, k3s...

CVE-2024-53259 vulnerabilities

Vulnerabilities for packages: traefik-fips, cloudflared, traefik, caddy, eks-distro-fips, q, spegel, frp, buf, kubernetes-dns-node-cache-fips, eks-distro, kubernetes-dns-node-cache, caddy-fips, k3s...

CVE-2024-51744 vulnerabilities

Vulnerabilities for packages: azcopy-fips, cluster-autoscaler-fips, secrets-store-csi-driver-provider-azure, flux-image-reflector-controller-fips, etcd, crossplane, cosign-fips, rclone, crossplane-provider-azure-managedidentity, git-sync, argo-workflows-fips, loki-fips, wal-g,...

CVE-2024-10125

The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcorevalidatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer ALB OpenId Connect integration and can be used in any ASP.NET...

CVE-2024-10125 Lack of JWT issuer and signer validation

The Amazon.ApplicationLoadBalancer.Identity.AspNetCore repo https://github.com/awslabs/aws-alb-identity-aspnetcorevalidatetokensignature contains Middleware that can be used in conjunction with the Application Load Balancer ALB OpenId Connect integration and can be used in any ASP.NET...

CVE-2024-10125

CVE-2024-10125 concerns the Amazon.ApplicationLoadBalancer.Identity.AspNetCore middleware used with ALB OpenID Connect in ASP.NET Core deployments. The root cause is that JWT handling performs signature validation but fails to validate the JWT issuer and signer identity, enabling a signed token f...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2024-041)

The version of docker installed on the remote host is prior to 25.0.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2024-041 advisory. 2025-01-04: CVE-2024-36620 was added to this advisory. 2025-01-04: CVE-2024-36623 was added to this advisory...

CVE-2024-35198 TorchServe bypass allowed_urls configuration

TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a fi...

CVE-2024-35199

CVE-2024-35199 concerns TorchServe where two gRPC ports (7070, 7071) were bound to all interfaces by default, not localhost, potentially exposing the service. The issue affects TorchServe in affected versions; the root cause is incorrect binding configuration, enabling network exposure. The advis...

CVE-2024-35199 TorchServe gRPC Port Exposure

TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. In affected versions the two gRPC ports 7070 and 7071, are not bound to localhost by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTor...

TorchServe gRPC Port Exposure

Impact The two gRPC ports 7070 and 7071, are not bound to localhost by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers DLC through Amazon SageMaker and EKS are not affected. Patches This issue in...

GHSA-HHPG-V63P-WP7W TorchServe gRPC Port Exposure

Impact The two gRPC ports 7070 and 7071, are not bound to localhost by default, so when TorchServe is launched, these two interfaces are bound to all interfaces. Customers using PyTorch inference Deep Learning Containers DLC through Amazon SageMaker and EKS are not affected. Patches This issue in...

TorchServe vulnerable to bypass of allowed_urls configuration

Impact TorchServe's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...

How to Configure EKS Clusters to Use AWS IAM Users/Roles for Veeam Kasten for Kubernetes Access

Purpose Follow this guide to provide appropriate Veeam Kasten for Kubernetes role-based access using AWS IAM users or roles. Solution Description Veeam Kasten for Kubernetes integrates with whatever authentication mechanism customers use to access their Kubernetes clusters. Since EKS natively...

Sail Further with Wiz Cost Optimization for Amazon EKS

Learn how Wiz's latest feature identifies outdated EKS clusters, helping organizations save millions on cloud spend. Find out how to optimize costs and reinvest savings in strategic initiatives...

CVE-2024-31989

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unprivileged pod in a different namespace on the same cluster could connect to the Redis server on port 6379. Despite having installed the latest version of the VPC CNI plugin on the EKS...

CVE-2024-31989

Argo CD (GitOps tool for Kubernetes) has a vulnerability where an unprivileged pod in a different namespace can reach the Redis server on port 6379, potentially leading to privilege escalation to the cluster controller or information leakage if Redis access is not restricted. The issue is mitigat...