203 matches found
Denial Of Service (DoS)
github.com/knative-extensions/eventing-github/ is vulnerable to Denial Of Service DoS. The vulnerability is caused due to missing ReadHeaderTimeout setting in the server. This could lead to a DDoS attack, where a large number of users send requests causing it to hang...
GHSA-V7HC-87JC-QRRR eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations
Impact The eventing-github cluster-local server doesn't set ReadHeaderTimeout which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to other users, also know as a Slowloris...
eventing-github vulnerable to denial of service caused by improper enforcement of the timeout on individual read operations
Impact The eventing-github cluster-local server doesn't set ReadHeaderTimeout which could lead do a DDoS attack, where a large group of users send requests to the server causing the server to hang for long enough to deny it from being available to other users, also know as a Slowloris...
Knative Serving Resource Consumption DoS
The vulnerability of the Knative Serving deployment and application management tool is related to an uncontrolled resource consumption when processing endpoints in the /metrics directory. Exploiting this vulnerability could allow a malicious actor to cause service failures...
CVE-2023-48713
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
Design/Logic Flaw
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713
Knative Serving (on Kubernetes) contains a DoS flaw (CVE-2023-48713) caused by an unbound memory allocation in the /metrics response. If an attacker controls a pod sufficiently to influence its responses, they can trigger a denial of service in the autoscaler. The issue is specific to the metrics...
CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713: Uncontrolled Resource Consumption
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
Knative Serving Security Vulnerability
Knative Serving is a Kubernetes-based build from Knative that supports the deployment and servicing of applications and features as serverless containers. A security vulnerability exists in Knative Serving that stems from a memory allocation error, which could lead to a denial of service by an...
GHSA-QMVJ-4QR9-V547 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Summary A vulnerability was fond in Knative Serving that could allow an attacker to crash the Knative Serving autoscaler resulting in a denial of service. The attacker would need to have compromised one pod in the Knative Serving deployment, and with that position they could launch the attack...
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Summary A vulnerability was fond in Knative Serving that could allow an attacker to crash the Knative Serving autoscaler resulting in a denial of service. The attacker would need to have compromised one pod in the Knative Serving deployment, and with that position they could launch the attack...
knative:FuzzDurableConnection: Segv on unknown address with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=4783742681219072 Project: knative Fuzzing Engine: libFuzzer Fuzz Target: FuzzDurableConnection Job Type: libfuzzerasanknative Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: NULL Sanitizer: address ASAN Crash...
knative:FuzzDurableConnection: Crash with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=4856490675798016 Project: knative Fuzzing Engine: libFuzzer Fuzz Target: FuzzDurableConnection Job Type: libfuzzerasanknative Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c000065738 Crash State: NULL Sanitizer: address ASAN...
knative:FuzzChildName: Null-dereference READ in pthread_create
Detailed Report: https://oss-fuzz.com/testcase?key=6476498750275584 Project: knative Fuzzing Engine: libFuzzer Fuzz Target: FuzzChildName Job Type: libfuzzerasanknative Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: pthreadcreate cgotrypthreadcreat...
knative:FuzzMessagingRoundTripTypesToJSON: Null-dereference READ with empty stacktrace
Detailed Report: https://oss-fuzz.com/testcase?key=5871730403180544 Project: knative Fuzzing Engine: libFuzzer Fuzz Target: FuzzMessagingRoundTripTypesToJSON Job Type: libfuzzerasanknative Platform Id: linux Crash Type: Null-dereference READ Crash Address: 0x000000000000 Crash State: NULL...
Information Disclosure
github.com/knative/func is vulnerable to information disclosure. The vulnerability is due to compromised third-party buildpacks which expose their registry credentials or local docker socket to a malicious lifecycle container, which allows remote attackers to access unauthorized information. This...