Security Bulletin: IBM Sterling Order Management Kubernetes vulnerability

Summary Kubernetes could allow a remote authenticated attacker to bypass security restrictions Vulnerability Details CVEID:CVE-2021-25741 DESCRIPTION: Kubernetes could allow a remote authenticated attacker to bypass security restrictions, caused by a symlink exchange flaw in kubelet. By sending a...

SUSE SLED15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2022:3666-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3666-1 advisory. helm was updated to version 3.9.4: CVE-2022-36055: Fixed denial of service through string value...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.9.50 bug fix and security update

Red Hat OpenShift Container Platform release 4.9.50 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.9. Red Hat Product Security has rated this update as having a...

SUSE-SU-2022:3666-1 Security update for helm

This update for helm fixes the following issues: helm was updated to version 3.9.4: CVE-2022-36055: Fixed denial of service through string value parsing bsc1203054. Updating the certificates used for testing Updating index handling helm was updated to version 3.9.3: - CVE-2022-1996: Updated...

GHSA-F4P5-X4VC-MH4V Improper use of metav1.Duration allows for Denial of Service

Flux controllers within the affected versions range are vulnerable to a denial of service attack. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout and structured...

Improper use of metav1.Duration allows for Denial of Service

Flux controllers within the affected versions range are vulnerable to a denial of service attack. Users that have permissions to change Flux’s objects, either through a Flux source or directly within a cluster, can provide invalid data to fields .spec.interval or .spec.timeout and structured...

Meet Wiz at KubeCon North America

Wiz will be attending and sponsoring KubeCon for the first time and we have a lot to share regarding how enterprises can better secure their container and Kubernetes environments. Come say hi!...

Denial Of Service (DoS)

istio is vulnerable to denial of service. The vulnerability is due to the Kubernetes validating or mutating webhook service being exposed to the public, allowing a malicious attacker to send a specially crafted oversized message resulting in a crash to the control plane...

Spring at JavaOne 2022

Hi, Spring fans! Its Sunday the 16th of October as I write this and Im winging my way to sunny Las Vegas, Nevada, where Ill be attending and presenting at the first JavaOne show in years! It didnt exist as the JavaOne we know and love for years, even before the pandemic interrupted life as we kno...

Security Bulletin: Multiple vulnerabilities in Kubernetes affect IBM InfoSphere Information Server

Summary Multiple vulnerabilities in Kubernetes used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2021-25745 DESCRIPTION: Kubernetes ingress-nginx could allow a remote authenticated attacker to obtain sensitive information, caused by improper access control...

Design/Logic Flaw

Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.5.3 security fixes and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.5.3 General Availability release images, which fix security issues and bugs, as well as update container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.8.51 packages and security update

Red Hat OpenShift Container Platform release 4.8.51 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.8. Red Hat Product Security has rated this update as having a...

PT-2022-24864 · Unknown +1 · Kubernetes +1

Name of the Vulnerable Software and Affected Versions: Istio versions prior to 1.15.2 Istio versions prior to 1.14.5 Istio versions prior to 1.13.9 Description: Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. The...

CVE-2022-39278

CVE-2022-39278 affects Istio across multiple releases (notably Istio 1.15.2, 1.14.5, 1.13.9) where the control plane istiod is vulnerable to a request-processing error caused by an inefficient Go regexp.Compile, leading to a crash when a specially crafted or oversized message is sent to the publi...

CVE-2022-39278 Istio vulnerable to denial of service attack due to Golang Regex Library

Istio is an open platform-independent service mesh that provides traffic management, policy enforcement, and telemetry collection. Prior to versions 1.15.2, 1.14.5, and 1.13.9, the Istio control plane, istiod, is vulnerable to a request processing error, allowing a malicious attacker that sends a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.36 security update

Red Hat OpenShift Container Platform release 4.10.36 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whi...

Microsoft Patch Tuesday Fixes New Windows Zero-Day; No Patch for Exchange Server Bugs

Microsoft's Patch Tuesday update for the month of October has addressed a total of 85 security vulnerabilities, including fixes for an actively exploited zero-day flaw in the wild. Of the 85 bugs, 15 are rated Critical, 69 are rated Important, and one is rated Moderate in severity. The update,...

Vulnerabilities fixed in Microsoft Azure

Vulnerabilities have been fixed in Microsoft Azure. The vulnerabilities allow a malicious party to obtain elevated privileges obtain or to impersonate another user. The vulnerability with attribute CVE-2022-37968 has a CVSS of 10.0. If an unauthenticated malicious person uses the randomly generat...

Microsoft Patch Tuesday, October 2022 Edition

Microsoft today released updates to fix at least 85 security holes in its Windows operating systems and related software, including a new zero-day vulnerability in all supported versions of Windows that is being actively exploited. However, noticeably absent from this months Patch Tuesday are any...