Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2022-24769)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd where containers were incorrectly started with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes API server security vulnerability (CVE-2021-25735)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in the Kubernetes API server that could allow node updates to bypass a validating admission webhook CVE-2021-25735 Vulnerability Details CVEID: CVE-2021-25735 Description: Kubernetes kube-apiserver could allow a remote...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2021-25737)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the Kubernetes API server that could allow a user to redirect pod traffic to private networks on a node CVE-2021-25737 Vulnerability Details CVEID: CVE-2021-25737 Description: Kubernetes could allow a remote...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2021-21334)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd that could allow containers using the same image to share environment variables CVE-2021-21334. Vulnerability Details CVEID: CVE-2021-21334 In containerd an industry-standard container runtime before...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a GNU GRUB2 security vulnerability (CVE-2020-10713)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in GNU GRUB2 that could allow a local authenticated attacker to execute arbitrary code on the system. CVE-2020-10713 Vulnerability Details CVEID: CVE-2020-10713 Description: GNU GRUB2 could allow a local authenticated...

Security Bulletin: Golang Vulnerabilities in IBM Cloud CLI 1.1.0 or earlier

Summary Golang vulnerabilities were found, which could allow an attacker to bypass security restrictions under some circumstances. IBM Cloud CLI version 1.1.0 or earlier is impacted by these vulnerabilities. Vulnerability Details CVEID: CVE-2020-15586 DESCRIPTION: Golang Go is vulnerable to a...

Security Bulletin: Windows installers of IBM Cloud CLI prior to 0.16.2 are signed using SHA1 certificate

Summary IBM Cloud CLI prior to 0.16.2 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a installer with malicious software inside. Vulnerability Details CVEID: CVE-2019-4427 DESCRIPTION: IBM Cloud CLI windows installers are...

Security Bulletin: Vulnerability of Embedded CF CLI In IBM Cloud CLI

Summary Default embedded CF CLI in IBM Cloud CLI version prior to 0.20.0 contains a security vulnerability which might expose customer credentials. Vulnerability Details CVEID: CVE-2019-3800 DESCRIPTION: CF CLI version prior to v6.45.0 bosh release version 1.16.0 writes the client id and secret t...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2020-8559)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the Kubernetes API server that could enable a privilege escalation from a compromised node CVE-2020-8559 Vulnerability Details CVEID: CVE-2020-8559 Description: Kubernetes kube-apiserver could allow a remote...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes API server security vulnerability (CVE-2019-11254)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in the Kubernetes API server that could lead to a denial of service vulnerability from malicious YAML payloads CVE-2019-11254 Vulnerability Details CVEID: CVE-2019-11254 Description: Kubernetes is vulnerable to a denia...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes API server security vulnerability (CVE-2020-8552)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in the Kubernetes API server that could lead to a denial of service CVE-2020-8552 Vulnerability Details CVEID: CVE-2020-8552 Description: Kubernetes kube-apiserver is vulnerable to a denial of service, caused by improp...

CVE-2019-4427

IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a installer with malicious software inside. IBM X-Force ID: 162773...

PT-2020-10949

Name of the Vulnerable Software and Affected Versions IBM Cloud CLI versions 0.6.0 through 0.16.1 Description The issue is related to the use of a weak algorithm, specifically SHA1, for signing windows installers. This could potentially allow an attacker to generate an installer with malicious...

CVE-2019-4427: Use of a Broken or Risky Cryptographic Algorithm

IBM Cloud CLI 0.6.0 through 0.16.1 windows installers are signed using SHA1 certificate. An attacker might be able to exploit the weak algorithm to generate a installer with malicious software inside. IBM X-Force ID: 162773...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by Kubernetes API server security vulnerability (CVE-2019-11253)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in the Kubernetes API server that exposes it to a denial of service attack via malicious YAML or JSON payloads CVE-2019-11253. Vulnerability Details CVE-ID: CVE-2019-11253 Description: The Kubernetes API server is...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by Kubernetes security vulnerability (CVE-2019-11247)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in Kubernetes API server that allows access to custom resources via wrong scope CVE-2019-11247. Vulnerability Details CVE-ID: CVE-2019-11247 Description: Kubernetes could allow a remote authenticated attacker to gain...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Python security vulnerability (CVE-2019-10160)

Summary IBM Cloud Kubernetes Service is vulnerable to CVE-2019-10160 Python security vulnerability which could allow a remote attacker to obtain sensitive information, caused by improper unicode encoding handling. Vulnerability Details CVE-ID: CVE-2019-10160 Description: Python...

Security Bulletin: IBM Cloud Kubernetes Service is impacted by a security vulnerability in Project Calico

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in Project Calico, the network CNI plugin used in IBM Cloud Kubernetes Service, which could result in weaker than expected network policy protection. Vulnerability Details CVEID: None available DESCRIPTION: Project Calic...

Security Bulletin: IBM Cloud Kubernetes Service is impacted by a security vulnerability in Project Calico

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in Project Calico, the network CNI plugin used in IBM Cloud Kubernetes Service. In some scenarios, Calico will write configuration data in log files including service account tokens included in the configuration. This wi...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a privilege escalation vulnerability in Kubernetes API server

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in Kubernetes which in some cases can allow unauthorized access to the Kubernetes API Server and/or trusted user privilege escalation. Vulnerability Details CVEID: CVE-2018-1002105 DESCRIPTION: Kubernetes could allow a...