CVE-2024-45794

Devtron (open source tool integration platform for Kubernetes) has a SQL Injection vulnerability in the CreateUser API (/orchestrator/user). An authenticated user with minimum permissions could exploit this to execute malicious SQL queries. The issue is addressed in version 0.7.2; upgrading is ad...

CVE-2024-45794 SQL Injection in CreateUser API in devtron

devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user with minimum permission could utilize and exploit SQL Injection to allow the execution of malicious SQL queries via CreateUser API /orchestrator/user. This issue has been addressed in...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.68 security update

Red Hat OpenShift Container Platform release 4.12.68 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

RHEL 8 / 9 : Red Hat Service Interconnect 1.4.5 Release (RHSA-2024:4125)

The remote Redhat Enterprise Linux 8 / 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2024:4125 advisory. As a Kubernetes user, I cannot connect easily connect services from one cluster with services on another cluster. Red Hat Application...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.12.0 security and bug fixes

Red Hat Advanced Cluster Management for Kubernetes 2.12.0 GA release images are now available, which contain security and bug fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detail...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.53 packages and security update

Red Hat OpenShift Container Platform release 4.13.53 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.20 packages and security update

Red Hat OpenShift Container Platform release 4.16.20 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

GHSA-29WX-VH33-7X7R vulnerabilities

Vulnerabilities for packages: tkn-fips, terraform-provider-azurerm, argo-workflows, kubeflow-katib, minio-operator-fips, git-sync, actions-runner-controller-fips, goreleaser, flux-source-controller-fips, grafana, gitea-fips, argo-rollouts-fips, secrets-store-csi-driver-provider-azure,...

CVE-2024-51744 vulnerabilities

Vulnerabilities for packages: tkn-fips, terraform-provider-azurerm, argo-workflows, kubeflow-katib, minio-operator-fips, git-sync, actions-runner-controller-fips, goreleaser, flux-source-controller-fips, grafana, gitea-fips, argo-rollouts-fips, secrets-store-csi-driver-provider-azure,...

AZL-52275 CVE-2024-51744 affecting package kubernetes for versions less than 1.28.4-17

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

AZL-52195 CVE-2024-51744 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

AZL-52204 CVE-2024-51744 affecting package kubernetes for versions less than 1.30.10-5

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

SUSE CVE-2024-9486

A security issue was discovered in the Kubernetes Image Builder versions = v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be...

CVE-2024-24786 affecting package kubernetes for versions less than 1.28.4-12

CVE-2024-24786 affecting package kubernetes for versions less than 1.28.4-12. A patched version of the package is available...

CVE-2024-28180 affecting package kubernetes for versions less than 1.28.4-12

CVE-2024-28180 affecting package kubernetes for versions less than 1.28.4-12. A patched version of the package is available...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.37 packages and security update

Red Hat OpenShift Container Platform release 4.15.37 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.37 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.37 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

BIT-ARGO-WORKFLOWS-2024-47827

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...