Moderate: Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.7.6 security and bug fix update

The Migration Toolkit for Containers MTC 1.7.6 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2022-23526

Technical details for CVE-2022-23526 are not publicly provided in the connected documents. What is shown is Helm pre-3.10.3 and a patch, but no deeper technical details. Monitor for updates.

CVE-2022-23526 Helm contains Denial of service through schema file

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in thechartutil package that can cause a segmentation violation. The chartutil package contains a parser that loads a JSON Schema validation file. For example,...

CVE-2022-23526 Helm contains Denial of service through schema file

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in thechartutil package that can cause a segmentation violation. The chartutil package contains a parser that loads a JSON Schema validation file. For example,...

CVE-2022-23525 Helm vulnerable to Denial of service via NULL Pointer Dereference

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the repopackage. The repo package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart...

CVE-2022-23525

CVE-2022-23525 affects Helm prior to 3.10.3. The issue is a NULL pointer dereference in the internal repo package that processes the repository index file; certain index formats can allocate array data structures that trigger a memory corruption/panic, leading to Denial of Service when parsed inp...

CVE-2022-23525 Helm vulnerable to Denial of service via NULL Pointer Dereference

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the repopackage. The repo package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart...

CVE-2022-23524 Helm vulnerable to Denial of service through string value parsing

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the strvals package can cause a stack overflow. In Go, a stack overflow cannot be recovered fro...

CVE-2022-23524 Helm vulnerable to Denial of service through string value parsing

Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the strvals package can cause a stack overflow. In Go, a stack overflow cannot be recovered fro...

CVE-2022-23524

CVE-2022-23524 (Helm) affects Helm up to 3.10.2, where inputs to the strvals package can trigger a stack overflow and uncontrolled resource consumption, leading to Denial of Service when used by Helm SDK applications. The issue is fixed in 3.10.3. Implication: a DoS condition if untrusted user in...

Important: Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.6.3 security update

Red Hat Advanced Cluster Management for Kubernetes 2.6.3 General Availability release images, which provide security updates, fix bugs, and update container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : containerd (SUSE-SU-2022:4463-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4463-1 advisory. Update to containerd v1.6.12 including Docker v20.10.21-ce bsc1206065. Also includes the followi...

Security Bulletin: Vulnerability in OAuthlib affects IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2022-36087)

Summary Denial of service vulnerability in OAuthlib may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift. Vulnerability Details CVEID:CVE-2022-36087 DESCRIPTION: OAuthlib is vulnerable to a denial of service, caused by improper input validation. By sendin...

Security Bulletin: Vulnerabilities in Redis affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift (CVE-2022-24736, CVE-2022-24735)

Summary Vulnerabilities in Redis, such as denial of service and execution of arbitrary code on the system, may affect IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift. Vulnerability Details CVEID:CVE-2022-24736 DESCRIPTION: Redis is vulnerable to a denial of...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : containerd vulnerabilities (USN-5776-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5776-1 advisory. It was discovered that containerd incorrectly handled memory when receiving certain faulty Exec or ExecSync commands. A remote...

SUSE SLES12 Security Update : containerd (SUSE-SU-2022:4409-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4409-1 advisory. Update to containerd v1.6.12 including Docker v20.10.21-ce bsc1206065. Also includes the following fix: - CVE-2022-23471: host memo...

Virtuozzo Hybrid Infrastructure 5.3 Update 1 (5.3.1-38)

This update provides new features for security, monitoring, and the compute service, as well as bug fixes and improvements. Vulnerability id: VSTOR-60452 It is impossible to start a cluster update after an eligibility check failure. Vulnerability id: VSTOR-60459 A stability fix for Windows...

Kibana 7.17.8 and 8.5.0 Security Update

Update Log 2022-12-23 : Updated impact section with additional details. 2023-01-09 : Updated impact section to include RHEL 2023-01-23 : Updated impact section with additional details. Updated Solutions and Mitigations section with new mitigation option. Updated Affected Versions section. Kibana...

Log4j: One Year Later

One year ago, the Log4j remote code execution vulnerability known as Log4Shell CVE-2021-44228 was announced. The critical severity level vulnerability in a logging framework used across virtually all Java environments quickly set the internet on fire when it was released and exploited. It’s...

OESA-2022-2132 kubernetes security update

Container cluster management. Security Fixes: kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.CVE-2021-25743...