GHSA-CX63-2MW6-8HW5 vulnerabilities

Vulnerabilities for packages: superset, py3-cassandra-medusa, airflow, nemo, nvidia-nsight-compute-13.2, py3.9-setuptools, nvidia-nsight-compute-13.1, py3-pipenv, reflex, checkov, az, request-1276, k8s-sidecar, kubeflow-katib...

CVE-2024-6345 vulnerabilities

Vulnerabilities for packages: superset, py3-cassandra-medusa, airflow, nemo, nvidia-nsight-compute-13.2, py3.9-setuptools, nvidia-nsight-compute-13.1, py3-pipenv, reflex, checkov, az, request-1276, k8s-sidecar, kubeflow-katib...

CVE-2024-3651 vulnerabilities

Vulnerabilities for packages: confluent-docker-utils, az, k8s-sidecar, kubeflow-volumes-web-app, py3-pipenv, checkov, ggshield, request-1276, dask-gateway, nvidia-nsight-compute-13.2, nvidia-nsight-compute-13.1, jwt-tool, py3-idna, py3-cassandra-medusa, kubeflow-jupyter-web-app, kserve,...

GHSA-248V-346W-9CWC vulnerabilities

Vulnerabilities for packages: jwt-tool, kubeflow-jupyter-web-app, kubeflow-pipelines, dask-gateway, superset, reflex, patroni, k8s-sidecar, py3-certifi, kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server, py3-pipenv, az, kubeflow-katib, mlflow, confluent-docker-utils, airflow,...

CVE-2024-39689 vulnerabilities

Vulnerabilities for packages: jwt-tool, kubeflow-jupyter-web-app, kubeflow-pipelines, dask-gateway, superset, reflex, patroni, k8s-sidecar, py3-certifi, kubeflow-volumes-web-app, kubeflow-pipelines-visualization-server, py3-pipenv, az, kubeflow-katib, mlflow, confluent-docker-utils, airflow,...

GO-2024-2930 RKE credentials are stored in the RKE1 Cluster state ConfigMap in github.com/rancher/rke

When RKE provisions a cluster, it stores the cluster state in a configmap called "full-cluster-state" inside the "kube-system" namespace of the cluster itself. This cluster state object contains information used to set up the K8s cluster, which may include sensitive data...

OPENSUSE-SU-2024:13370-1 etcd-for-k8s1.26-3.5.9-1.1 on GA media

These are all security issues fixed in the etcd-for-k8s1.26-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13369-1 etcd-for-k8s1.25-3.5.9-1.1 on GA media

These are all security issues fixed in the etcd-for-k8s1.25-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:13371-1 etcd-for-k8s1.27-3.5.9-1.1 on GA media

These are all security issues fixed in the etcd-for-k8s1.27-3.5.9-1.1 package on the GA media of openSUSE Tumbleweed...

Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094 Basic POC to test CVE-2024-3094 vulnerability in...

CVE-2024-35195 vulnerabilities

Vulnerabilities for packages: jwt-tool, reflex, superset, patroni, az, k8s-sidecar, kubeflow-jupyter-web-app, kubeflow-pipelines, kubeflow-katib, kubeflow-pipelines-visualization-server, py3-pipenv, ggshield, mlflow, confluent-docker-utils, airflow, py3-cassandra-medusa, kubeflow-volumes-web-app,...

GHSA-9WX4-H78V-VM56 vulnerabilities

Vulnerabilities for packages: jwt-tool, reflex, superset, patroni, az, k8s-sidecar, kubeflow-jupyter-web-app, kubeflow-pipelines, kubeflow-katib, kubeflow-pipelines-visualization-server, py3-pipenv, ggshield, mlflow, confluent-docker-utils, airflow, py3-cassandra-medusa, kubeflow-volumes-web-app,...

TotalCloud Container Security Best Practices

Qualys Container Security CS, an integral part of TotalCloud 2.0, provides a comprehensive view of the security posture of containerized applications. Operationalizing a new technology tool in an enterprise often presents its own challenges. This blog seeks to help the operations team familiarize...

GHSA-JJG7-2V4V-X38H vulnerabilities

Vulnerabilities for packages: confluent-docker-utils, az, k8s-sidecar, kubeflow-volumes-web-app, py3-pipenv, checkov, ggshield, request-1276, dask-gateway, nvidia-nsight-compute-13.2, nvidia-nsight-compute-13.1, jwt-tool, py3-idna, py3-cassandra-medusa, kubeflow-jupyter-web-app, kserve,...

OS Command Injection

github.com/fluid-cloudnative/fluid is vulnerable to OS Command Injection. The vulnerability is due to insufficient input validation within the JuicefsRuntime, allowing an authenticated user with the authority to create or update the K8s CRD Dataset/JuicefsRuntime to execute arbitrary OS commands...

Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime

Impact OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to...

GHSA-WX8Q-4GM9-RJ2G Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime

Impact OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to...

NamespaceHound: protecting multi-tenant K8s clusters

NamespaceHound is an open-source tool for detecting the risk of potential namespace crossing violations and anonymous access opportunities in multi-tenant clusters...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: helm-operator-fips, atlantis, kubewatch, nats, terraform-docs, slsa-verifier, crossplane-provider-aws-rds, gitness, metacontroller, kubescape, scorecard, caddy-fips, cass-operator-fips, temporal-fips, dex, falcoctl-fips, minio, k9s, boring-registry, grype,...

Design/Logic Flaw

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which...