Oracle Linux 8 : kubernetes (ELSA-2022-10036)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-10036 advisory. - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.24 - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.23 - Resolve...

Access Restriction Bypass

kubeview is vulnerable to access restriction bypass. The vulnerability exists in default function of api.js, because api/scrape/kube-system does not require authentication which allows an attacker to bypass the restrictions and retrieve certificate files that can be used to authenticate as...

PT-2022-27692 · Kubeview · Kubeview

Name of the Vulnerable Software and Affected Versions: KubeView versions 0.1.31 and earlier Description: The issue allows attackers to obtain control of a Kubernetes cluster because the api/scrape/kube-system endpoint does not require authentication, and it retrieves certificate files that can be...

KubeView 访问控制错误漏洞

KubeView is a Kubernetes cluster visualizer and graphical viewer by Ben Coleman, an individual developer. An access control error vulnerability exists in versions of KubeView prior to 0.1.31, which stems from the fact that its api / scraper /kube-system does not require authentication and retriev...

Rocky Linux 8 : container-tools:4.0 (RLSA-2022:7469)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7469 advisory. - runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 whe...

Oracle Linux 8 : container-tools:3.0 (ELSA-2022-7529)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-7529 advisory. - fixes CVE-2021-3602 - amend CVE-2022-1708 - fix CVE-2022-1708 - thanks to Peter Hunt - fix CVE-2022-27650 - fixes CVE-2021-3602 - rc95 fixes...

AlmaLinux 8 : container-tools:4.0 (ALSA-2022:7469)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:7469 advisory. cri-o: memory exhaustion on the node when access to the kube api CVE-2022-1708 golang: crash in a golang.org/x/crypto/ssh server CVE-2022-27191 runc:...

CVE-2022-3294

A flaw was found in Kubernetes, where users may have access to secure endpoints in the control plane network. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While...

Kubernetes 安全漏洞

Kubernetes K8s is an open source system from the Cloud Native Computing Foundation for automating the deployment, scaling, and management of containerized applications. A security vulnerability exists in Kubernetes kube-apiserver, which stems from the fact that an attacker can read sensitive...

SUSE SLES15 Security Update : conmon (SUSE-SU-2022:3896-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2022:3896-1 advisory. conmon was updated to 2.1.3: Stop using gunixsignaladd to avoid threads Rename CLI optionlog-size-global-max to log-global-size-max Update t...

Node address isn't always verified when proxying

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H A security issue was discovered in Kubernetes where users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them...

RHEL 8 : container-tools:4.0 (RHSA-2022:7469)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7469 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: cri-o:...

OESA-2022-1979 kubernetes security update

Container cluster management. Security Fixes: A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to thir...

CVE-2022-3172

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This issue leads to the client performing unexpected actions and forwarding the client's API server credentials to third parties...

RHEL 7 : OpenShift Container Platform 3.11.715 (RHSA-2022:4999)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2022:4999 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud...

RHEL 7 / 8 : OpenShift Container Platform 4.6.59 (RHSA-2022:4947)

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:4947 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

GHSA-69CG-P879-7622 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, grpcurl, dynamic-localpv-provisioner-fips, hey, kubeflow-katib, terraform-provider-sendgrid, k3d, wireguard-go, kubeflow, kube-state-metrics, kubeflow-fips, dynamic-localpv-provisioner...

CVE-2022-27664 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid-fips, grpcurl, dynamic-localpv-provisioner-fips, hey, kubeflow-katib, terraform-provider-sendgrid, k3d, wireguard-go, kubeflow, kube-state-metrics, kubeflow-fips, dynamic-localpv-provisioner...

Oracle Linux 7 : cri-o (ELSA-2022-9719)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-9719 advisory. 1.22.5-1 - Addresses CVE-2022-1708 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has...

Oracle Linux 7 : cri-o (ELSA-2022-9717)

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-9717 advisory. - Addresses CVE-2022-1708 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not teste...