10693 matches found
Git credentials are exposed in Atlantis logs
Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. Thi...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.40 packages and security update
Red Hat OpenShift Container Platform release 4.14.40 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.40 bug fix and security update
Red Hat OpenShift Container Platform release 4.14.40 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...
EulerOS 2.0 SP9 : docker-runc (EulerOS-SA-2024-2810)
According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and...
CVE-2024-45794
devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. This issue has been addressed in...
CVE-2024-45794 SQL Injection in CreateUser API in devtron
devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. This issue has been addressed in...
CVE-2024-45794 SQL Injection in CreateUser API in devtron
devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. This issue has been addressed in...
CVE-2024-45794
Devtron (open source tool integration platform for Kubernetes) has a SQL Injection vulnerability in the CreateUser API (/orchestrator/user). An authenticated user with minimum permissions could exploit this to execute malicious SQL queries. The issue is addressed in version 0.7.2; upgrading is ad...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.68 security update
Red Hat OpenShift Container Platform release 4.12.68 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...
RHEL 8 / 9 : Red Hat Service Interconnect 1.4.5 Release (RHSA-2024:4125)
The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4125 advisory. As a Kubernetes user, I cannot connect easily connect services from one cluster with services on another cluster. Red Hat Application...
Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.12.0 security and bug fixes
Red Hat Advanced Cluster Management for Kubernetes 2.12.0 GA release images are now available, which contain security and bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detail...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.53 packages and security update
Red Hat OpenShift Container Platform release 4.13.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.20 packages and security update
Red Hat OpenShift Container Platform release 4.16.20 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...
GHSA-29WX-VH33-7X7R vulnerabilities
Vulnerabilities for packages: cluster-autoscaler-fips, terraform-provider-azurerm, mc-fips, tkn, crossplane-provider-azure-managedidentity, temporal, minio-fips, secrets-store-csi-driver-provider-azure-fips, atlantis-fips, docker, argo-events, mc, rclone, opentelemetry-collector-contrib-fips,...
CVE-2024-51744 vulnerabilities
Vulnerabilities for packages: cluster-autoscaler-fips, terraform-provider-azurerm, mc-fips, tkn, crossplane-provider-azure-managedidentity, temporal, minio-fips, secrets-store-csi-driver-provider-azure-fips, atlantis-fips, docker, argo-events, mc, rclone, opentelemetry-collector-contrib-fips,...
AZL-52275 CVE-2024-51744 affecting package kubernetes for versions less than 1.28.4-17
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
AZL-52204 CVE-2024-51744 affecting package kubernetes for versions less than 1.30.10-5
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
AZL-52195 CVE-2024-51744 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1
golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...
SUSE CVE-2024-9486
A security issue was discovered in the Kubernetes Image Builder versions = v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be...
