MAL-2024-11545 Malicious code in byted-flux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a8424c4934716d4a7390731613807c89bca1d0f11a56e3062dacef247d859e80 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

GHSA-29WX-VH33-7X7R vulnerabilities

Vulnerabilities for packages: buildkitd, crossplane-provider-family-azure, actions-runner-controller, temporal-server, kubernetes, tekton-chains, tkn, argo-events, crossplane-provider-azure-storage, terraform, flux-source-controller, terraform-provider-azurerm, zarf, cosign, ko, kaniko, flyte,...

CVE-2024-51744 vulnerabilities

Vulnerabilities for packages: buildkitd, crossplane-provider-family-azure, actions-runner-controller, temporal-server, kubernetes, tekton-chains, tkn, argo-events, crossplane-provider-azure-storage, terraform, flux-source-controller, terraform-provider-azurerm, zarf, cosign, ko, kaniko, flyte,...

CVE-2024-34155 vulnerabilities

Vulnerabilities for packages: step-issuer, tkn, victoriametrics-cluster-fips, crossplane-provider-aws-sqs, nri-mssql, gops, flux-image-reflector-controller-fips, q, supercronic, sbomqs, prometheus-alertmanager-fips, nri-haproxy, docker-credential-acr-env, prometheus-mysqld-exporter, etcd,...

AZL-48327 CVE-2024-43806 affecting package flux for versions less than 0.194.5-4

Rustix is a set of safe Rust bindings to POSIX-ish APIs. When using rustix::fs::Dir using the linuxraw backend, it's possible for the iterator to "get stuck" when an IO error is encountered. Combined with a memory over-allocation issue in rustix::fs::Dir::readmore, this can cause quick and...

GO-2022-0960 Flux CLI Workload Injection in github.com/fluxcd/flux2

Flux CLI Workload Injection in github.com/fluxcd/flux2...

GHSA-V23V-6JW2-98FQ vulnerabilities

Vulnerabilities for packages: helm-operator, dive, dagdotdev, tkn, rancher-fleet, tkn-fips, opentelemetry-collector-contrib, vexctl, buildkitd, policy-controller-fips, opentelemetry-collector-fips, chartmuseum, flux-image-reflector-controller, k3d, skopeo, neuvector-scanner,...

MAL-2024-2963 Malicious code in rippling-flux-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rippling-flux-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rippling-flux-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2964 Malicious code in rippling-flux-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rippling-flux-dev (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2962 Malicious code in rippling-flux-dev (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in flux_dev_tools.server.flask (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2384 Malicious code in flux_dev_tools (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: buildkitd, spire-server, tempo, sigstore-scaffolding, thanos, tekton-chains, tkn, velero, argo-events, zarf, flux-source-controller, opentelemetry-collector, cosign, flyte, py3-azure-identity, nuclei, flux, grafana-agent-operator, hugo-extended, kubescape, up,...

GHSA-V554-XWGW-HC3W source-controller leaks Azure Storage SAS token into logs

Impact When source-controller is configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access t...

Source controller 安全漏洞

Source controller is a component of the Flux project. A security vulnerability exists in source-controller versions prior to 1.2.5. An attacker can exploit this vulnerability to gain access to Azure Blob Storage...

CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: helm-operator, wavefront-collector-for-kubernetes, dive, kube-bench, cert-manager-webhook-pdns, litefs, addon-resizer-fips, cert-exporter, kubernetes-dashboard-fips, boring-registry, dynamic-localpv-provisioner, prometheus-alertmanager, croc, frp, prometheus-adapter,...

GHSA-C5Q2-7R4C-MV6G vulnerabilities

Vulnerabilities for packages: tkn, kubernetes-dashboard-fips, vexctl, frp, policy-controller-fips, grpc-health-probe, terragrunt, rabbitmq-messaging-topology-operator, minio, temporal-ui-server, skopeo, gomplate-fips, rancher-agent, step-ca, argo-workflows, fulcio-fips, neuvector-fips,...