Moderate: Red Hat Security Advisory: OpenShift Container Platform 3.11.404 security and bug fix update

Red Hat OpenShift Container Platform release 3.11.404 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, whi...

Low: Red Hat Security Advisory: AMQ Online 1.7.0 release and security update

An update of the Red Hat OpenShift Container Platform 3.11 and 4.6/4.7 container images is now available for Red Hat AMQ Online. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

fabric8-kubernetes-client: vulnerable to a path traversal leading to integrity and availability compromise

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.1.5 security and bug fix update

Red Hat Advanced Cluster Management for Kubernetes 2.1.5 General Availability release images, which fix several bugs and security issues. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a...

Secure containerized environments with updated threat matrix for Kubernetes

Last April, we released the first version of the threat matrix for Kubernetes. It was the first attempt to systematically map the threat landscape of Kubernetes. As we described in the previous post, we chose to adapt the structure of MITRE ATT&CK® framework which, became almost an industry...

Secure containerized environments with updated threat matrix for Kubernetes

Last April, we released the first version of the threat matrix for Kubernetes. It was the first attempt to systematically map the threat landscape of Kubernetes. As we described in the previous post, we chose to adapt the structure of MITRE ATT&CK® framework which, became almost an industry...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a containerd security vulnerability (CVE-2021-21334)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability found in containerd that could allow containers using the same image to share environment variables CVE-2021-21334. Vulnerability Details CVEID: CVE-2021-21334 In containerd an industry-standard container runtime before...

Photon OS 2.0: Kubernetes PHSA-2021-2.0-0326

An update of the kubernetes package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2021-2.0-0326. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Kubernetes: SHA512 incorrect on most/many releases

Report Submission Form Summary: SHA512 is incorrect for most versions of kubernetes.tar.gz releases https://github.com/kubernetes/kubernetes/releases/. Kubernetes Version: all Component Version: all Steps To Reproduce: add details for how we can reproduce the issue, including relevant cluster set...

Moderate Photon OS Security Update - PHSA-2021-0247

Updates of 'calico', 'kubernetes' packages of Photon OS have been released...

The vulnerabilities of Azure Container Instance, Azure Service Fabric, Azure Kubernetes Service, Azure Container Registry, and Azure Spring Cloud involve a lack of protection for service data, allowing attackers to gain unauthorized access to protected information.

The vulnerabilities of Azure Container Instance, Azure Service Fabric, Azure Kubernetes Service, Azure Container Registry, and Azure Spring Cloud are related to the lack of protection for service data. Exploiting these vulnerabilities can allow an attacker operating remotely to gain unauthorized...

CVE-2021-20218

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...

CVE-2021-20218

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...

CVE-2021-20218

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...

Design/Logic Flaw

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...

CVE-2021-20218

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...

CVE-2021-20218

The CVE refers to fabric8 kubernetes-client vulnerability affecting version 4.2.0 and later, where a malicious pod/container can abuse the client’s copy command to extract files outside the working path, impacting integrity and availability. Fixed in kubernetes-client releases 4.13.2, 5.0.2, 4.11...

Securing Containers and Kubernetes-Orchestrated Environments

In a recent Black Hat webcast, “Securing Containers and Kubernetes-Orchestrated Environments,” sponsored by VMware Carbon Black, guest speakers Sheila A. Berta, Offensive Security Specialist, Dreamlab Technologies and Haim Helman, CTO, VMware Carbon Black App Security, VMware Security Business...

Rohan Kumar kubernetes-client 路径遍历漏洞

Rohan Kumar kubernetes-client is an open source application by Rohan Kumar. Provides smooth DSL access to the full Kubernetes and OpenShift REST APIs. A security vulnerability exists in fabric8 kubernetes-client in version 4.2.0 and after, which stems from the copy command lifting files outside o...

Fedora 33 : containerd (2021-470fa24f5b)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-470fa24f5b advisory. - In containerd an industry-standard container runtime before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation...