CVE-2022-24298

All versions of package freeopcua/freeopcua are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False...

Denial of Service (DoS)

Overview node-opcua is an implementation of a OPC UA stack fully written in javascript and nodejs Affected versions of this package are vulnerable to Denial of Service DoS when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the...

Virtuozzo Hybrid Infrastructure 5.2 Hotfix 1 (5.2.0-141)

This update provides important fixes for the compute service. Vulnerability id: VSTOR-56942 If a virtual machine is connected to a VLAN-based physical network, the VM may have no network connectivity after its migration due to a missing ARP announcement. Vulnerability id: VSTOR-56792, VSTOR-56789...

GHSA-VJXV-45G9-9296 cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists

cosign verify-attestation used with the --type flag will report a false positive verification when: - There is at least one attestation with a valid signature - There are NO attestations of the type being verified --type defaults to "custom" This can happen when signing with a standard keypair an...

cosign's `cosign verify-attestaton --type` can report a false positive if any attestation exists

cosign verify-attestation used with the --type flag will report a false positive verification when: - There is at least one attestation with a valid signature - There are NO attestations of the type being verified --type defaults to "custom" This can happen when signing with a standard keypair an...

GHSA-739F-HW6H-7WQ8 PolicyController before 0.2.1 may bypass attestation verification

PolicyController will report a false positive, resulting in an admission when it should not be admitted when: There is at least one attestation with a valid signature There are NO attestations of the type being verified --type defaults to "custom" Users should upgrade to cosign version 0.2.1 or...

PolicyController before 0.2.1 may bypass attestation verification

PolicyController will report a false positive, resulting in an admission when it should not be admitted when: There is at least one attestation with a valid signature There are NO attestations of the type being verified --type defaults to "custom" Users should upgrade to cosign version 0.2.1 or...

Now it's BlenderBot's turn to make shocking, inappropriate, and untrue remarks

Last Friday, Meta unveiled its new BlenderBot 3 AI chatbot, a conversational AI prototype. The company said its chatbot is designed to learn by having natural conversations with people online. It also improves its skills via human feedback. Meta also asserts with confidence that the more the AI...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : bind (SUSE-SU-2022:2713-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2713-1 advisory. - CVE-2021-25219: Fixed flaw that allowed abusing lame cache to severely degrade resolver...

The Truth About False Positives in Security

TL;DR: As weird as it might sound, seeing a few false positives reported by a security scanner is probably a good sign and certainly better than seeing none. Let's explain why. Introduction False positives have made a somewhat unexpected appearance in our lives in recent years. I am, of course,...

The Truth About False Positives in Security

TL;DR: As weird as it might sound, seeing a few false positives reported by a security scanner is probably a good sign and certainly better than seeing none. Let's explain why. Introduction False positives have made a somewhat unexpected appearance in our lives in recent years. I am, of course,...

CVE-2022-35929

A flaw was found in the cosign package. The cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid signature and when there are no attestations of the type being verified for example, —type defaults to...

Supply Chain Attack

Policy-controller is vulnerable to supply chain attack. Due to a flaw in the function ValidatePolicyAttestationsForAuthority, images will be reported as false positives resulting in admission in specific conditions. An attacker can use this vulnerability to run unsigned images...

DHS says to update your Emergency Alert Systems immediately

The Department of Homeland Security has issued an advisory after vulnerabilities were found in its Emergency Alert Systems EAS. EAS technology is designed to fire out warning messages during times of national emergency. It can be used to warn of coastal flooding, earthquakes, child abduction,...

Design/Logic Flaw

PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are ...

CVE-2022-35930 Ability to bypass attestation verification in sigstore PolicyController

PolicyController is a utility used to enforce supply chain policy in Kubernetes clusters. In versions prior to 0.2.1 PolicyController will report a false positive, resulting in an admission when it should not be admitted when there is at least one attestation with a valid signature and there are ...

CVE-2022-35930

CVE-2022-35930 affects PolicyController (Sigstore) before version 0.2.1, which may report false positives in attestation verification and admit unsigned images when there is a valid attestation but no matching type. The issue is a logic/validation flaw in PolicyController used to enforce Kubernet...

CVE-2022-35929

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

Design/Logic Flaw

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...

CVE-2022-35929 False positive signature verification in cosign

cosign is a container signing and verification utility. In versions prior to 1.10.1 cosign can report a false positive if any attestation exists. cosign verify-attestation used with the --type flag will report a false positive verification when there is at least one attestation with a valid...