GHSA-7WW5-4WQC-M92C vulnerabilities

Vulnerabilities for packages: zot, kots, gitness, kaniko, newrelic-infrastructure-agent, k8sgpt, eksctl, skaffold, melange, kubescape, flux-helm-controller, grype, trivy, kubevela, buildkitd, flux-source-controller, ctop, helm-push, k3d, up, cilium-cli, fuse-overlayfs-snapshotter, helm...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

GHSA-45X7-PX36-X8W8 vulnerabilities

Vulnerabilities for packages: spire-server, bom, slsa-verifier, conftest, step, pulumi, spark-operator, prometheus-postgres-exporter, scorecard, go-licenses, dockerize-fips, prometheus-elasticsearch-exporter-fips, sigstore-scaffolding-fips, gitsign, melange, kube-state-metrics,...

CVE-2023-2253 affecting package helm for versions less than 3.13.2-1

CVE-2023-2253 affecting package helm for versions less than 3.13.2-1. An upgraded version of the package is available that resolves this issue...

olcne security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build 2.1.3.3 - Add OL9 support 2.1.3.2 - Update inline with Linux team building conmon for all but OL7. cri-o...

CVE-2023-47640

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

Default credentials

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubevela, scorecard, slsa-verifier, buildkitd, terraform-provider-sendgrid, aactl, dgraph, cortex, k3d, src, spark-operator, up, kubescape, kubeflow...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: conftest-fips, kubeflow-fips, slsa-verifier, src, bank-vaults-fips, cortex, spark-operator, prometheus-blackbox-exporter, scorecard, terraform-provider-sendgrid-fips, smarter-device-manager-fips, aws-efs-csi-driver-fips, plutono-fips, vault-csi-provider,...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2023:4124-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4124-1 advisory. helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action...

SUSE: Security Advisory (SUSE-SU-2023:4124-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:4124-1 Security update for helm

This update for helm fixes the following issues: helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action FIX Default ServiceAccount yaml fixregistry: unswallow error remove useless print during prepareUpgrade fixregistry:...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller-fips, grpcurl, bom, slsa-verifier, kubernetes-ingress-defaultbackend, pulumi, spark-operator, newrelic-infrastructure-agent, prometheus-postgres-exporter, secrets-store-csi-driver-provider-gcp, prometheus-elasticsearch-exporter-fips,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: aws-load-balancer-controller-fips, grpcurl, bom, slsa-verifier, kubernetes-ingress-defaultbackend, pulumi, spark-operator, newrelic-infrastructure-agent, prometheus-postgres-exporter, secrets-store-csi-driver-provider-gcp, prometheus-elasticsearch-exporter-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kaf, certificate-transparency, spark-operator, kubeflow, kubevela, slsa-verifier, pulumi-language-java, pulumi-language-dotnet, scorecard, conftest, hey, nats, k3d, kubescape, kpt, gobuster, nodetaint, mc, secrets-store-csi-driver, src, grype, flux-source-controller,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: grpcurl, bom, slsa-verifier, conftest, pulumi, spark-operator, newrelic-infrastructure-agent, prometheus-postgres-exporter, secrets-store-csi-driver-provider-gcp, scorecard, kube-state-metrics, terraform-provider-azurerm, prometheus-stackdriver-exporter,...

AZL-33343 CVE-2023-44487 affecting package helm for versions less than 3.14.0-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...