GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: gh, karpenter, local-path-provisioner, nova, oras, temporal, nodetaint, flux-notification-controller, supercronic, mountpoint-s3-csi-driver, osv-scanner, grafana-rollout-operator, polaris, aws-privateca-issuer, clickhouse-operator, victoriametrics,...

GO-2022-0960 Flux CLI Workload Injection in github.com/fluxcd/flux2

Flux CLI Workload Injection in github.com/fluxcd/flux2...

GO-2022-0447 Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2

Improper path handling in kustomization files allows path traversal in github.com/fluxcd/flux2...

source-controller leaks Azure Storage SAS token into logs

Impact When source-controller is configured to use an Azure SAS token when connecting to Azure Blob Storage, the token was logged along with the Azure URL when the controller encountered a connection error. An attacker with access to the source-controller logs could use the token to gain access t...

GO-2022-1071 Denial of service in flux controllers in github.com/fluxcd modules

Flux controllers are vulnerable to a denial of service attack. Users that have permissions to change Flux's objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout and structured variations of these fields, causing the...

Denial Of Service (DoS)

github.com/fluxcd is vulnerable to Denial of Service. The vulnerability exists due to the lack of data fields validation in the metav1.Duration parameter in multiple fluxcd repositories which allows an attacker to cause an application crash...

Denial Of Service (DoS)

github.com/fluxcd/helm-controller and github.com/fluxcd/flux2 are vulnerable to denial of service DoS attacks. A remote authenticated attacker is able to cause a system panic by supplying specific data inputs, resulting in denial of service conditions via high memory consumption...

Path Traversal

github.com/fluxcd/flux2 is vulnerable to path traversal. The vulnerability exists because the library does not properly handle the user-supplied input, allowing an attacker to access files outside the expected directory and replace the flux deployment information with arbitrary content...

Remote Code Execution (RCE)

github.com/fluxcd is vulnerable to remote code execution. The vulnerability exists due to a lack of validation of access and sanitization of flagging inputs which allows a malicious user to inject and execute arbitrary javascript code...