GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, k3d, kubeflow-fips, prometheus-stackdriver-exporter, kubernetes-csi-livenessprobe-fips, kubernetes-csi-livenessprobe, aactl, conftest-fips, aws-efs-csi-driver-fips, bank-vaults-fips, slsa-verifier, scorecard, buildkitd,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: spark-operator, kubescape, slsa-verifier, src, scorecard, cortex, buildkitd, dgraph, up, k3d, kubevela, terraform-provider-sendgrid, kubeflow, aactl...

SUSE: Security Advisory (SUSE-SU-2023:4124-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2023:4124-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4124-1 advisory. helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action...

SUSE-SU-2023:4124-1 Security update for helm

This update for helm fixes the following issues: helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action FIX Default ServiceAccount yaml fixregistry: unswallow error remove useless print during prepareUpgrade fixregistry:...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: metacontroller, hugo, amass, timoni, kubewatch, dive, kubeflow-katib, kubernetes-csi-livenessprobe-fips, prometheus-postgres-exporter-fips, azure-aad-pod-identity-mic, prometheus-node-exporter, slsa-verifier, kube-logging-logging-operator, minio,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: metacontroller, hugo, amass, timoni, kubewatch, dive, kubeflow-katib, kubernetes-csi-livenessprobe-fips, prometheus-postgres-exporter-fips, azure-aad-pod-identity-mic, prometheus-node-exporter, slsa-verifier, kube-logging-logging-operator, minio,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: metacontroller, hugo, amass, kubewatch, kubeflow-katib, kubernetes-csi-livenessprobe-fips, slsa-verifier, certificate-transparency, minio, gke-gcloud-auth-plugin, timestamp-authority-fips, mc, kiam, metrics-server, wireguard-go, fuse-overlayfs-snapshotter,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kind, amass, rqlite, nats, helm, skaffold, pulumi-kubernetes-operator, gobuster, flux-notification-controller, prometheus-adapter, dynamic-localpv-provisioner, terraform-provider-aws, pulumi-language-yaml, spark-operator, nghttp2, kubeflow-katib, wireguard-go,...

AZL-34799 CVE-2023-44487 affecting package helm for versions less than 3.15.2-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-33343 CVE-2023-44487 affecting package helm for versions less than 3.14.0-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

GHSA-622H-H2P8-743X JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

Impact A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. Patches Upgrade to NeuVector version 5.2.2 or later and latest Helm chart 2.6.3+....

Path Traversal

github.com/argoproj/argo-cd/v2 is vulnerable to Path Traversal. The vulnerability is caused by a missing validation check in the repo server API that prevents file traversal attacks. This can lead to an attacker leaking values or files from the referenced Helm Chart by using a using a...

CVE-2023-40026

A flaw was found in Argo CD. For any version using Helm, using a specially crafted Helm file could reference external Helm charts handled by the same repo-server to leak values or files from the referenced Helm Chart. This issue is possible because the Helm paths were predictable. Mitigation...

CVE-2023-40026

CVE-2023-40026 describes a path traversal in Argo CD prior to version 2.3 where a specially crafted Helm file could reference external Helm charts handled by the repo-server, allowing leakage of values or files from the referenced charts due to predictable Helm paths. Exploitation requires access...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

GHSA-6JQW-JWF5-RP8H Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

ArgoCD Path Traversal Vulnerability

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...