PT-2023-27220 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions prior to 2.3 Description: Argo CD is a declarative continuous deployment framework for Kubernetes. The issue allows an attacker to reference external Helm charts handled by the same repo-server to leak values or files from th...

SUSE SLES15 / openSUSE 15 Security Update : terraform-provider-helm (SUSE-SU-2023:3587-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3587-1 advisory. - rebuild the package with the go 1.21 security release bsc1212475. Tenable has extracted the preceding description block...

PT-2023-36262 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security release in Go 1.21. The terraform-provider-helm package has been rebuilt with this security release to address the issue. There is no...

GHSA-G687-F2GX-6WM8 Argo CD repo-server Denial of Service vulnerability

Impact All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious,...

Argo CD repo-server Denial of Service vulnerability

Impact All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious,...

CVE-2023-40584

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

Design/Logic Flaw

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

CVE-2023-40584 Denial of Service to Argo CD repo-server

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

CVE-2023-40584

CVE-2023-40584 affects Argo CD repo-server (all Argo CD versions from v2.4). The root cause is a Denial-of-Service vulnerability where the repo-server unpacks a user-controlled tar.gz without validating the inner files’ size and with insufficient checks on extracted file permissions before deleti...

CVE-2023-40584 Denial of Service to Argo CD repo-server

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

CVE-2023-40584 Denial of Service to Argo CD repo-server

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

SUSE SLES15 Security Update : terraform-provider-helm (SUSE-SU-2023:3508-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3508-1 advisory. - rebuild the package with the go 1.21 security release bsc1212475. Tenable has extracted the preceding description block directly from the...

PT-2023-36252 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the go 1.21 security release. Recommendations: At the moment, there is no information abo...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. An attacker can cause an application crash by uploading a maliciously crafted Helm chart...

kubernetes security update

kubernetes 1.25.11-1 - Added Oracle specific build files for Kubernetes olcne 1.6.2-1 - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x 1.6.1-9 - Updated the CVE ID's in Istio-1.16.4 changelog entry 1.6.1-8 - Update Istio...

kubernetes security update

kubernetes 1.25.11-1 - Added Oracle specific build files for Kubernetes olcne 1.6.2-1 - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x 1.6.1-9 - Updated the CVE ID's in Istio-1.16.4 changelog entry 1.6.1-8 - Update Istio...

openSUSE 15 Security Update : terraform-provider-helm (SUSE-SU-2023:2752-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:2752-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding description block directly from the SUSE security...

SUSE SLES15 Security Update : terraform-provider-helm (SUSE-SU-2023:2750-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2750-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding description block directly from the...

SUSE-SU-2023:2750-1 Security update for terraform-provider-helm

This update of terraform-provider-helm fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

PT-2023-36212 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.20. The terraform-provider-helm package has been rebuilt to incorporate this security...