GHSA-7WW5-4WQC-M92C vulnerabilities

Vulnerabilities for packages: helm-push, melange, fuse-overlayfs-snapshotter, flux-source-controller, skaffold, kots, k8sgpt, gitness, cilium-cli, zot, newrelic-infrastructure-agent, grype, kaniko, eksctl, buildkitd, ctop, helm, kubescape, trivy, flux-helm-controller, kubevela, k3d, up...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

conmon security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build cri-o 1.26.3-3 - Resolve CVE-2023-39325 1.26.3-2 - Add support for ARM build cri-tools 1.26.1-3 - Resolve...

GHSA-45X7-PX36-X8W8 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, prometheus-node-exporter-fips, aactl, melange, certificate-transparency-fips, sigstore-scaffolding-fips, src-fingerprint, gitsign, flux-source-controller, terraform, prometheus-pushgateway, metrics-server, go-licenses,...

CVE-2023-2253 affecting package helm for versions less than 3.13.2-1

CVE-2023-2253 affecting package helm for versions less than 3.13.2-1. An upgraded version of the package is available that resolves this issue...

olcne security update

conmon 2.1.3-7 - Resolve CVE-2023-39325 2.1.3-6 - Add ol8baseoslatest, and ol9baseoslatest, to Jenkinsfile 2.1.3-5 - Add systemd-devel as build requirement 2.1.3-4 - Add support ARM build 2.1.3.3 - Add OL9 support 2.1.3.2 - Update inline with Linux team building conmon for all but OL7. cri-o...

CVE-2023-47640

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

Default credentials

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

CVE-2023-47640 Insecure Use of HMAC-SHA1 For Session Signing in datahub

DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key. SHA1 with a 10 byte key can be brute forced using sufficient resources i.e. state level actors with large computational capabilities...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: smarter-device-manager-fips, dynamic-localpv-provisioner-fips, plutono-fips, prometheus-stackdriver-exporter, aactl, kubernetes-csi-livenessprobe, kube-oidc-proxy, metrics-server-fips, prometheus-adapter-fips, vault-csi-provider, kubeflow, dgraph, scorecard,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: spark-operator, k3d, kubeflow, kubevela, src, buildkitd, slsa-verifier, up, kubescape, terraform-provider-sendgrid, dgraph, aactl, cortex, scorecard...

SUSE: Security Advisory (SUSE-SU-2023:4124-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2023:4124-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4124-1 advisory. helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action...

SUSE-SU-2023:4124-1 Security update for helm

This update for helm fixes the following issues: helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action FIX Default ServiceAccount yaml fixregistry: unswallow error remove useless print during prepareUpgrade fixregistry:...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, prometheus-node-exporter-fips, kubernetes-ingress-defaultbackend, aactl, fuse-overlayfs-snapshotter, flux-source-controller, terraform, prometheus-pushgateway, stakater-reloader, metrics-server, minio, aws-load-balancer-controller,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: wavefront-collector-for-kubernetes, prometheus-node-exporter-fips, kubernetes-ingress-defaultbackend, aactl, fuse-overlayfs-snapshotter, flux-source-controller, terraform, prometheus-pushgateway, stakater-reloader, metrics-server, minio, aws-load-balancer-controller,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kots, kubeflow, slsa-verifier, fuse-overlayfs-snapshotter, pulumi-kubernetes-operator, scorecard, terraform-provider-azurerm, flux-kustomize-controller, kind, terraform, kubescape, grype, kubernetes-csi-livenessprobe, kubewatch, kubevela, gke-gcloud-auth-plugin,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: aactl, fuse-overlayfs-snapshotter, flux-source-controller, terraform, stakater-reloader, metrics-server, minio, dex, hey, atlantis, timestamp-authority-fips, kaf, nri-prometheus, prometheus-bind-exporter, bank-vaults-fips, secrets-store-csi-driver, cosign, buildkitd,...

AZL-33343 CVE-2023-44487 affecting package helm for versions less than 3.14.0-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...