CVE-2024-4436

The etcd package distributed with the Red Hat OpenStack platform has an incomplete fix for CVE-2022-41723. This issue occurs because the etcd package in the Red Hat OpenStack platform is using http://golang.org/x/net/http2 instead of the one provided by Red Hat Enterprise Linux versions, meaning ...

Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to ETCD logs Information disclosure vulnerabilitiy.(CVE-2023-40694)

Summary Potential ETCD logs Information disclosure vulnerabilitiy CVE-2023-40694 has been identified that may affect IBM Watson CP4D Data Stores. The vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-40694 DESCRIPTION: IBM Watson...

RHEL 9 : Red Hat OpenStack Platform 17.0 (etcd) (RHSA-2023:3441)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3441 advisory. A highly-available key value store for shared configuration Security Fixes: Information discosure via debug function CVE-2021-28235 Key name...

RHEL 8 : Red Hat OpenStack Platform (etcd) (RHSA-2023:1275)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:1275 advisory. etcd is a highly-available key value store for shared configuration. The following Important impact security fixes are applicable to Red Hat...

RHEL 9 : Red Hat OpenStack Platform 17.0 (etcd) (RHSA-2023:1014)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:1014 advisory. A highly-available key value store for shared configuration Security Fixes: Improve heuristics preventing CPU/memory abuse by parsing malicious or...

RHEL 8 : Red Hat OpenStack Platform 16.1 (etcd) (RHSA-2023:3447)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3447 advisory. A highly-available key value store for shared configuration Security Fixes: Information discosure via debug function CVE-2021-28235...

cri-o security update

cri-o 1.26.4-2 - Address CVE-2024-24786 cri-tools 1.26.1-5 - Address CVE-2024-24786 etcd 3.5.10-3 - Address protobuf CVE-2024-24786 3.5.10-1 - Added Oracle specific build files istio 1.17.8-3 - Address protobuf CVE-2024-24786 - Backport from 1.19.7 to address CVE-2024-23322, CVE-2024-23323,...

cri-o security update

cri-o 1.26.4-2 - Address CVE-2024-24786 cri-tools 1.26.1-5 - Address CVE-2024-24786 etcd 3.5.10-3 - Address protobuf CVE-2024-24786 3.5.10-1 - Added Oracle specific build files istio 1.17.8-3 - Address protobuf CVE-2024-24786 - Backport from 1.19.7 to address CVE-2024-23322, CVE-2024-23323,...

RHEL 8 : Red Hat OpenStack Platform 16.2 (etcd) (RHSA-2023:3445)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3445 advisory. A highly-available key value store for shared configuration Security Fixes: Information discosure via debug function CVE-2021-28235...

cri-o security update

cri-o 1.25.5-2 - Address CVE-2024-24786 cri-tools 1.25.0-4 - Address CVE-2024-24786 etcd 3.5.9-4 - Address protobuf CVE-2024-24786 3.5.9-3 - Address CVE-2023-39326 by upgrading golang to version 1.20.12 istio 1.16.7-4 - Address protobuf CVE-2024-24786 - Backport from 1.19.7 to address...

cri-o security update

cri-o 1.25.5-2 - Address CVE-2024-24786 cri-tools 1.25.0-4 - Address CVE-2024-24786 etcd 3.5.9-4 - Address protobuf CVE-2024-24786 3.5.9-3 - Address CVE-2023-39326 by upgrading golang to version 1.20.12 istio 1.16.7-4 - Address protobuf CVE-2024-24786 - Backport from 1.19.7 to address...

The vulnerability of the Etcd configuration store, related to incorrect authentication, allows attackers to escalate their privileges.

The vulnerability of the Etcd configuration store is related to the sending of authentication requests to the etcdserver with a username and password. Exploiting this vulnerability can allow an attacker, operating remotely, to increase their privileges...

ROS-20240411-02

The Etcd configuration parameter store vulnerability is related to sending an authentication request to the etcdserver with a username and password. Exploitation of the vulnerability could allow an attacker, acting remotely to escalate their privileges...

AZL-39484 CVE-2023-45288 affecting package etcd for versions less than 3.5.12-2

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-38281 CVE-2023-45288 affecting package etcd for versions less than 3.5.18-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2023-39325 affecting package etcd for versions less than 3.5.6-11

CVE-2023-39325 affecting package etcd for versions less than 3.5.6-11. A patched version of the package is available...

CVE-2023-44487 affecting package etcd for versions less than 3.5.6-11

CVE-2023-44487 affecting package etcd for versions less than 3.5.6-11. A patched version of the package is available...

conmon security update

conmon 2.1.3-8 - address CVE-2023-39326 cri-o 1.26.4-1 - Added Oracle Specific Files for cri-o - Cherry-picked upstream commits for OCPBUGS-17150: oci: simplify stopping code https://github.com/cri-o/cri-o/pull/7185 - Fixed CVE-2023-39325: bump golang.org/x/net to v0.17.0 cri-tools 1.26.1-4 -...

conmon security update

conmon 2.1.3-8 - address CVE-2023-39326 cri-o 1.26.4-1 - Added Oracle Specific Files for cri-o - Cherry-picked upstream commits for OCPBUGS-17150: oci: simplify stopping code https://github.com/cri-o/cri-o/pull/7185 - Fixed CVE-2023-39325: bump golang.org/x/net to v0.17.0 cri-tools 1.26.1-4 -...

BIT-ETCD-2020-15106 Improper Input Validation in etcd

In etcd before versions 3.3.23 and 3.4.10, a large slice causes panic in decodeRecord method. The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentional...