51 matches found
CLEANSTART-2026-HE89623 Security fix for ghsa-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.18.0-r3, kube-state-metrics-fips 2.19.1-r1, istio-pilot-discovery 1.31.1-r0
ghsa-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-ZG24378 Security fix for CVE-2025-61727 applied in: apache-nifi 2.10.0-r4, aws-flb-firehose 1.7.2-r0, aws-flb-kinesis 1.10.3-r0, calico-fips 3.31.2-r1, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cloudnative-pg-fips 1.24.4-r0, cloudnative-pg-fips 1.25.4-r0, cloudnative-pg-fips 1.26.2-r0, cni-plugin-flannel 1.6.0-r0, cni-plugins-fips 1.8.0-r0, configmap-reload 0.15.0-r0, consul-k8s-fips 1.7.8-r0, consul-k8s-fips 1.8.6-r0, consul-k8s-fips 1.9.1-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, docker-fips 28.4.0-r0, druid-exporter-fips 0.10-r1, druid-exporter-fips 0.11-r2, eck-operator 3.2.0-r1, eks-distro-kube-apiserver-fips 1.34.2-r0, elastic-beats-fips 9.2.2-r0, external-dns 0.18.0-r0, external-dns-fips 0.20.0-r0, external-secrets 0.20.4-r0, flux-notification-controller-fips 1.5.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.25 1.25.6-r1, gomplate-fips 4.3.3-r3, harbor-registry 3.0.0.1-r2, harbor-registry-fips 2.6.2-r0, harbor-registry-fips 2.7.1-r0, harbor-registry-fips 2.8.3-r0, harbor-registry-fips 3.0.0-r1, helm-fips 3.17-4-r0, helm-fips 3.19.0-r1, helm-fips 4.0.1-r0, helm-operator-fips 1.39.0-r1, helm-operator-fips 1.41.1-r1, ip-masq-agent 2.12.6-r1, istio-operator-fips 1.25.5-r0, istio-operator-fips 1.26.7-r0, istio-operator-fips 1.27.4-r0, istio-operator-fips 1.28.1-r0, istio-operator-fips 1.4.10-r6, istio-pilot-discovery 1.28.1-r0, istio-pilot-discovery-fips 1.25.5-r0, istio-pilot-discovery-fips 1.26.7-r0, istio-pilot-discovery-fips 1.27.4-r0, istio-pilot-discovery-fips 1.28.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, k8ssandra-operator-fips 1.26.0-r0, k8ssandra-operator-fips 1.27.0-r0, k8ssandra-operator-fips 1.28.0-r0, k8ssandra-operator-fips 1.29.0-r0, kaniko-fips 1.24.0-r0, kapp-controller 0.59.0-r1, kapp-controller-fips 0.59.0-r1, kube-rbac-proxy-fips 0.17.1-r1, kube-rbac-proxy-fips 0.18.2-r2, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kube-state-metrics-fips 2.14.0-r0, kube-state-metrics-fips 2.15.0-r0, kube-state-metrics-fips 2.17.0-r0, kubernetes 1.31.14-r1, kubernetes 1.32-10-r1, kubernetes 1.33.6-r0, kubernetes 1.34.2-r0, kubernetes-csi-external-resizer-fips 2.0.0-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kubernetes-csi-node-driver-registrar-fips 2.15.0-r0, kubernetes-fips 1.31.14-r0, kubernetes-fips 1.32.10-r0, kubernetes-fips 1.32.2-r0, kubernetes-fips 1.33.6-r0, kured 1.20.0-r0, metallb-fips 0.14.9-r1, metrics-server 0.8.0-r0, metrics-server-fips 0.5.2-r1, metrics-server-fips 0.6.4-r1, metrics-server-fips 0.7.2-r3, metrics-server-fips 0.8.0-r5, minio-operator 7.1.1-r3, mongodb 8.2.1-r1, mongodb 8.2.6-r1, multus-cni-fips 4.0.2-r3, multus-cni-fips 4.1.4-r4, multus-cni-fips 4.2.3-r1, nginx-prometheus-exporter 1.5.1-r0, nginx-prometheus-exporter-fips 1.5.1-r0, nvidia-container-toolkit 1.19.0-r0, openbao-fips 2.4.4-r2, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, opentofu-fips 1.10.7-r0, opentofu-fips 1.7.10-r0, opentofu-fips 1.8.11-r0, opentofu-fips 1.9.4-r1, prometheus-fips 3.5.0-r4, prometheus-fips 3.9.0-r0, prometheus-node-exporter 1.8.0-r3, prometheus-node-exporter-fips 1.10.2-r0, prometheus-node-exporter-fips 1.7.0-r1, prometheus-node-exporter-fips 1.8.2-r1, prometheus-node-exporter-fips 1.9.1-r0, prometheus-operator-fips 0.85.0-r1, prometheus-operator-fips 0.86.2-r0, prometheus-operator-fips 0.87.0-r0, prometheus-redis-exporter-fips 1.77.0-r0, prometheus-redis-exporter-fips 1.78.0-r0, prometheus-redis-exporter-fips 1.79.0-r0, promxy 0.0.93-r1, rabbitmq-messaging-topology-operator 1.15.0-r1, restic 0.18.0-r0, runc 1.1.14-r0, smarter-device-manager-fips 1.20.12-r0, spark-operator 2.2.1-r0, spire-server-fips 1.13.3-r0, stakater-reloader-fips 1.1.0-r3, stakater-reloader-fips 1.2.1-r1, stakater-reloader-fips 1.3.0-r0, stakater-reloader-fips 1.4.10-r0, step-issuer-fips 0.9.11-r1, step-issuer-fips 0.9.9-r2, tekton-pipelines 1.5.0-r0, tekton-pipelines-fips 1.5.0-r0, tempo 2.9.0-r0, terragrunt-fips 0.90.2-r0, terragrunt-fips 0.91.5-r0, terragrunt-fips 0.92.1-r0, terragrunt-fips 0.93.13-r1, thanos-operator-fips 0.3.7-r0, trino 479-r0, velero 1.17.0-r1, velero-fips 1.14.1-r1, velero-fips 1.16.2, vertical-pod-autoscaler 1.5.1-r0, vertical-pod-autoscaler-fips 1.5.1-r0, volume-modifier-for-k8s 0.9.0-r0, volume-modifier-for-k8s-fips 0.9.0-r0, wave-fips 0.10.0-r0, wave-fips 0.9.0-r3
CVE-2025-61727 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-CP77103 Security fixes in istio-pilot-discovery-fips 1.26.7-r0
Package istio-pilot-discovery-fips version 1.26.7-r0 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...
CLEANSTART-2026-GR62343 Security fixes in istio-pilot-discovery 1.28.3-r0
Package istio-pilot-discovery version 1.28.3-r0 fixes 1 vulnerabilities: ghsa-9h8m-3fm2-qjrq...
CLEANSTART-2026-HX84275 Security fixes in istio-pilot-discovery 1.28.1-r0
Package istio-pilot-discovery version 1.28.1-r0 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...
PT-2026-85891
Package istio-pilot-discovery version 1.28.3-r0 fixes 1 vulnerabilities: ghsa-9h8m-3fm2-qjrq...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the jwksUri field of the RequestAuthentication resource. An attacker can access internal network resources by specifying a URL pointing to an internal service, causing the system to make unauthenticat...
Use of Hard-coded Credentials
Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the JWKS resolver, which can be exposed if a fetch operation fails. An attacker can obtain private keys by forcing such a failure. Note: The keys are exposed even if RequestAuthentication is in use...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizeDebugRequest function, which handles requests to the HTTP debug endpoints on port 15014. An attacker can gain unauthorized access to protected services by sending requests with multiple header values...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizeDebugRequest function, which handles requests to the HTTP debug endpoints on port 15014. An attacker can gain unauthorized access to protected services by sending requests with multiple header values...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizeDebugRequest function, which handles requests to the HTTP debug endpoints on port 15014. An attacker can gain unauthorized access to protected services by sending requests with multiple header values...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in AuthorizeDebugRequest function, which handles requests to the HTTP debug endpoints on port 15014. An attacker can gain unauthorized access to protected services by sending requests with multiple header values...
CLEANSTART-2026-XB34574 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate
Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...
CLEANSTART-2026-IM73098 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate
Multiple security vulnerabilities affect the istio-pilot-discovery package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...
CLEANSTART-2026-TF52804 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate
Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...
CLEANSTART-2026-BL06950 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate
Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...
CLEANSTART-2026-CK72347 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate
Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...
CVE-2022-31045 vulnerabilities
Vulnerabilities for packages: istio-pilot-agent, istio-operator, istio-pilot-discovery, istio-cni...