GHSA-54RR-7FVW-6X8F vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, ruby3.2-rack...

GHSA-54RR-7FVW-6X8F vulnerabilities

Vulnerabilities for packages: ruby3.2-rack, kube-fluentd-operator...

SUSE CVE-2024-0793

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn...

CVE-2021-44716 affecting package kube-vip-cloud-provider for versions less than 0.0.2-16

CVE-2021-44716 affecting package kube-vip-cloud-provider for versions less than 0.0.2-16. A patched version of the package is available...

kube-controller-manager Input Validation Error Vulnerability

kube-controller-manager is a kube-controller-manager component configuration API for Kubernetes open source. A security vulnerability exists in kube-controller-manager. An attacker exploited the vulnerability to cause a denial of service on the system...

Denial Of Service (DoS)

apimachinery is vulnerable to Denial Of Service DoS. The vulnerability is due to improper depth restrictions when parsing YAML or JSON. This issue can be exploited by an attacker via sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, resulting DoS...

CVE-2022-21698 affecting package kube-vip-cloud-provider for versions less than 0.0.2-14

CVE-2022-21698 affecting package kube-vip-cloud-provider for versions less than 0.0.2-14. A patched version of the package is available...

RHCOS 4 : OpenShift Container Platform 4.12.24 (RHSA-2023:3976)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:3976 advisory. - kube-apiserver: PrivEsc CVE-2023-1260 Note that Nessus has not tested for this issue but has instead relied only on the application's...

RHCOS 4 : OpenShift Container Platform 4.11.46 (RHSA-2023:4312)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:4312 advisory. - kube-apiserver: PrivEsc CVE-2023-1260 Note that Nessus has not tested for this issue but has instead relied only on the application's...

RHCOS 4 : OpenShift Container Platform 4.10.67 (RHSA-2023:4898)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:4898 advisory. - kube-apiserver: PrivEsc CVE-2023-1260 Note that Nessus has not tested for this issue but has instead relied only on the application's...

SUSE CVE-2023-32191

When RKE provisions a cluster, it stores the cluster state in a configmap called full-cluster-state inside the kube-system namespace of the cluster itself. The information available in there allows non-admin users to escalate to admin...

VulnCheck KEV: CVE-2022-45933

KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. NOTE: the vendor's position is that KubeView was a "fun side...

CVE-2022-3172

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties...

Design/Logic Flaw

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties...

UBUNTU-CVE-2022-3172

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties...

CVE-2022-3172

CVE-2022-3172 : Kubernetes kube-apiserver SSRF vulnerability allowing an aggregated API server to redirect client traffic to an arbitrary URL, potentially causing unintended actions and leaking API server credentials. Connected sources confirm affected product families (kube-apiserver) and that a...

CVE-2022-3172

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties...

CVE-2023-5408 Openshift: modification of node role labels

A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes and gain broader access to the clust...

Misconfiguration Of LoadBalancer Service

github.com/kubernetes/kubernetes is vulnerable to Misconfiguration of LoadBalancer Service. The vulnerability is present in the proxier.go. In the context of Kube-proxy on Windows, there is an issue where it can inadvertently forward traffic to local processes that are listening on the same port ...

Kube-proxy may unintentionally forward traffic

Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port spec.ports.port as a LoadBalancer Service when the LoadBalancer controller does not set the status.loadBalancer.ingress.ip field. Clusters where the LoadBalancer controller sets the...