GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips, slsa-verifier, scorecard, up, timestamp-authority-fips, prometheus-stackdriver-exporter, dynamic-localpv-provisioner-fips, terraform-provider-sendgrid, terraform-provider-sendgrid-fips, k3d, kubescape, aactl, kubeflow-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: dgraph, slsa-verifier, terraform-provider-sendgrid, src, k3d, aactl, kubevela, up, kubeflow, spark-operator, buildkitd, scorecard, kubescape, cortex, prometheus-blackbox-exporter...

SUSE: Security Advisory (SUSE-SU-2023:4124-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2023:4124-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4124-1 advisory. helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action...

SUSE-SU-2023:4124-1 Security update for helm

This update for helm fixes the following issues: helm was updated to version 3.13.1: Fixing precedence issue with the import of values. Add missing with clause to release gh action FIX Default ServiceAccount yaml fixregistry: unswallow error remove useless print during prepareUpgrade fixregistry:...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: configmap-reload-fips, slsa-verifier, kpt, k8sgpt-operator, nodetaint, kubernetes-dns-node-cache, prometheus-elasticsearch-exporter-fips, kind, hugo, prometheus-stackdriver-exporter, chartmuseum, falcoctl, memcached-exporter, prometheus-postgres-exporter-fips,...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: configmap-reload-fips, slsa-verifier, kpt, k8sgpt-operator, nodetaint, kubernetes-dns-node-cache, prometheus-elasticsearch-exporter-fips, kind, hugo, prometheus-stackdriver-exporter, chartmuseum, falcoctl, memcached-exporter, prometheus-postgres-exporter-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: configmap-reload-fips, slsa-verifier, kpt, nodetaint, kind, hugo, prometheus-stackdriver-exporter, memcached-exporter, atlantis, atlantis-fips, k3d, kubeflow-katib, prometheus-adapter, wireguard-go, metrics-server, nginx-mainline, vault-k8s-fips, falcoctl-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: rqlite, src, aactl, cosign, pulumi, terraform-provider-sendgrid, grype, gitness, kaf, kubernetes-csi-livenessprobe, dynamic-localpv-provisioner, hugo, weaviate, pulumi-language-java, nats, pulumi-language-dotnet, amass, oauth2-proxy, conftest, kubeflow-katib, cue,...

AZL-34799 CVE-2023-44487 affecting package helm for versions less than 3.15.2-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-33343 CVE-2023-44487 affecting package helm for versions less than 3.14.0-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

GHSA-622H-H2P8-743X JWT token compromise can allow malicious actions including Remote Code Execution (RCE)

Impact A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE. Patches Upgrade to NeuVector version 5.2.2 or later and latest Helm chart 2.6.3+....

Path Traversal

github.com/argoproj/argo-cd/v2 is vulnerable to Path Traversal. The vulnerability is caused by a missing validation check in the repo server API that prevents file traversal attacks. This can lead to an attacker leaking values or files from the referenced Helm Chart by using a using a...

CVE-2023-40026

A flaw was found in Argo CD. For any version using Helm, using a specially crafted Helm file could reference external Helm charts handled by the same repo-server to leak values or files from the referenced Helm Chart. This issue is possible because the Helm paths were predictable. Mitigation...

CVE-2023-40026

CVE-2023-40026 describes a path traversal in Argo CD prior to version 2.3 where a specially crafted Helm file could reference external Helm charts handled by the repo-server, allowing leakage of values or files from the referenced charts due to predictable Helm paths. Exploitation requires access...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

CVE-2023-40026 Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to le...

GHSA-6JQW-JWF5-RP8H Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

Path traversal allows leaking out-of-bound Helm charts from Argo CD repo-server

Impact In Argo CD versions prior to 2.3 starting at least in v0.1.0, but likely in any version using Helm before 2.3, using a specifically-crafted Helm file could reference external Helm charts handled by the same repo-server to leak values, or files from the referenced Helm Chart. This was...

ArgoCD Path Traversal Vulnerability

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository, automatically synchronizing and deploying...