CVE-2024-12582

CVE-2024-12582 affects the Skupper/Red Hat Service Interconnect console. A flaw in the default authentication method persists a random admin password in plaintext in a Kubernetes secret or podman volume, enabling an attacker to read user files inside the container and potentially trigger resource...

SUSE CVE-2024-43803

The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost BMH CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the Name and Namespace of th...

SUSE CVE-2023-3676

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

SUSE CVE-2023-3955

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...

MAL-2024-12078 Malicious code in kubernetes-jobs-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f29c07041ce33c528ad150db3916598a7a3f185ca196c18df969a2dc1ad3d4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kubernetes-jobs-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f29c07041ce33c528ad150db3916598a7a3f185ca196c18df969a2dc1ad3d4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-10220 affecting package kubernetes for versions less than 1.30.3-1

CVE-2024-10220 affecting package kubernetes for versions less than 1.30.3-1. An upgraded version of the package is available that resolves this issue...

AZL-54500 CVE-2024-45338 affecting package kubernetes for versions less than 1.28.4-14

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-54425 CVE-2024-45338 affecting package kubernetes for versions less than 1.30.3-2

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-45338 vulnerabilities

Vulnerabilities for packages: dataplaneapi, envoy-gateway, kubeflow-pipelines, kube-logging-operator, distribution, argo-rollouts, spiffe-helper, vault-benchmark, crossplane-provider-aws-rds, kiali, osv-scanner, gcsfuse, docker-cli-buildx, flux-helm-controller, aws-privateca-issuer, guac,...

AZL-54431 CVE-2024-45338 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.2-3

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

AZL-54555 CVE-2024-45338 affecting package application-gateway-kubernetes-ingress for versions less than 1.4.0-24

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service...

CVE-2024-45338 vulnerabilities

Vulnerabilities for packages: rancher-webhook, flux-image-automation-controller-fips, ko-fips, docker, distribution, grafana-rollout-operator, helm-fips, rook, actions-runner-controller, grafana-agent-operator, slsa-verifier, local-static-provisioner-fips, kyverno-notation-aws,...

Moderate: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.11.4 security enhancements and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.11.4 General Availability release images, which provide enhancements, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS ba...

Moderate: Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.6.4 security enhancements and bug fixes

Multicluster Engine for Kubernetes 2.6.4 General Availability release images, which provide enhancements, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which...

Important: Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.4.0 release.

Red Hat Developer Hub 1.4 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single pa...

Low: Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.3.3 bugfix release

Red Hat Developer Hub 1.3.3 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

BIT-GITLAB-2024-11274 URL Redirection to Untrusted Site ('Open Redirect') in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...

OESA-2024-2532 kubernetes security update

Container cluster management. Security Fixes: A vulnerability, which was classified as problematic, was found in Kubernetes up to 1.28.11/1.29.6/1.30.2 Virtualization Software. Affected is an unknown code block of the component gitRepo Volume Handler. Upgrading to version 1.28.12, 1.29.7, 1.30.3 ...

UBUNTU-CVE-2024-11274

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration...