CVE-2023-40584

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

Design/Logic Flaw

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

CVE-2023-40584 Denial of Service to Argo CD repo-server

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

CVE-2023-40584

CVE-2023-40584 affects Argo CD repo-server (all Argo CD versions from v2.4). The root cause is a Denial-of-Service vulnerability where the repo-server unpacks a user-controlled tar.gz without validating the inner files’ size and with insufficient checks on extracted file permissions before deleti...

CVE-2023-40584 Denial of Service to Argo CD repo-server

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

CVE-2023-40584 Denial of Service to Argo CD repo-server

Argo CD is a declarative continuous deployment for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating...

SUSE SLES15 Security Update : terraform-provider-helm (SUSE-SU-2023:3508-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:3508-1 advisory. - rebuild the package with the go 1.21 security release bsc1212475. Tenable has extracted the preceding description block directly from the...

PT-2023-36252 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the go 1.21 security release. Recommendations: At the moment, there is no information abo...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. An attacker can cause an application crash by uploading a maliciously crafted Helm chart...

kubernetes security update

kubernetes 1.25.11-1 - Added Oracle specific build files for Kubernetes olcne 1.6.2-1 - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x 1.6.1-9 - Updated the CVE ID's in Istio-1.16.4 changelog entry 1.6.1-8 - Update Istio...

kubernetes security update

kubernetes 1.25.11-1 - Added Oracle specific build files for Kubernetes olcne 1.6.2-1 - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11 - Add all modules to registry-image-helper - update yq to 4.x 1.6.1-9 - Updated the CVE ID's in Istio-1.16.4 changelog entry 1.6.1-8 - Update Istio...

openSUSE 15 Security Update : terraform-provider-helm (SUSE-SU-2023:2752-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:2752-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding description block directly from the SUSE security...

SUSE SLES15 Security Update : terraform-provider-helm (SUSE-SU-2023:2750-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2750-1 advisory. - rebuild the package with the go 1.20 security release bsc1206346. Tenable has extracted the preceding description block directly from the...

SUSE-SU-2023:2750-1 Security update for terraform-provider-helm

This update of terraform-provider-helm fixes the following issues: - rebuild the package with the go 1.20 security release bsc1206346...

PT-2023-36212 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security release in the Go programming language, version 1.20. The terraform-provider-helm package has been rebuilt to incorporate this security...

PT-2023-36210 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security concern addressed by rebuilding the package with the go 1.20 security release. Recommendations: At the moment, there is no information abo...

SUSE SLED15 / SLES15 Security Update : terraform-provider-helm (SUSE-SU-2023:2322-2)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:2322-2 advisory. - rebuild the package with the go 1.19 security release bsc1200441. Tenable has extracted the preceding description blo...

SUSE-SU-2023:2322-2 Security update for terraform-provider-helm

This update of terraform-provider-helm fixes the following issues: - rebuild the package with the go 1.19 security release bsc1200441...

PT-2023-36186 · Hashicorp · Terraform-Provider-Helm

Name of the Vulnerable Software and Affected Versions: terraform-provider-helm affected versions not specified Description: The issue is related to a security release in Go 1.19. The estimated number of potentially affected devices worldwide is not available. There is no information about...

AZL-27027 CVE-2023-2253 affecting package helm for versions less than 3.13.2-1

A flaw was found in the /v2/catalog endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned query string: n. This vulnerability allows a malicious user to submit an unreasonably large value for n, causing the allocation of a massive strin...