This Week in Spring - April 12th, 2022 (Devnexus 2022 Edition!!)

This Week in Spring - Devnexus Edition Hi, Spring fans! Welcome to another installment of This Week in Spring - Im at my first in-person event since the virus: Devnexus! WOOHOOO!! Well, technically Im still in San Francisco as I write this, but Ill be in Atlanta, GA tomorrow for… Devnexus! I hope...

Authentication flaw

Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api...

CVE-2022-24829

Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.8.36 security update

Red Hat OpenShift Container Platform release 4.8.36 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

Security Bulletin: Multiple Vulnerabilities affect IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data

Summary IBM has released the following fix for IBM® Db2® On Openshift and IBM® Db2® and Db2 Warehouse® on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. Vulnerability Details CVEID: CVE-2021-38561 DESCRIPTION: Golang Go Text is vulnerable to a denial of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.8.36 security update

Red Hat OpenShift Container Platform release 4.8.36 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

CVE-2022-24829

CVE-2022-24829 affects Garden, an automation platform for Kubernetes development and testing. In versions before 0.12.39, multiple endpoints did not require authentication, with the configuration exposed via the local /api endpoint on a server bound to 0.0.0.0, making it accessible on the network...

CVE-2022-24829 Missing authentication in Garden

Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api...

CVE-2022-24829 Missing authentication in Garden

Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.7.47 bug fix and security update

Red Hat OpenShift Container Platform release 4.7.47 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.7. Red Hat Product Security has rated this update as having a...

Gardener 访问控制错误漏洞

Gardener is an open source Kubernetes cluster management tool. The product supports managing, monitoring, and updating Kubernetes clusters. Gardener suffers from an Access Control Error vulnerability that allows an attacker to incorrectly access the application. Configuration is leaked via a /api...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.9.27 bug fix and security update

Red Hat OpenShift Container Platform release 4.9.27 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.9. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.10.8 bug fix and security update

Red Hat OpenShift Container Platform release 4.10.8 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a...

The vulnerability of the Kubernetes cluster management software, related to errors in processing hypertext links, allows a hacker to access confidential data.

The vulnerability of the Kubernetes cluster management software is related to errors in processing hypertext links. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...

This Week in Spring - April 5th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Im back home from the Hawaiin islands. Its so good to be home. First things first: theres a security vulnerability. Weve already released guidance on how to mitigate as well as new releases of Spring Framework and Spring Boot...

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD, related to access control deficiencies, allows a perpetrator to increase their privileges.

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the Kubeclient::Config implementation in the REST API client for Kubernetes allows a attacker to perform a “man-in-the-middle” attack.

The vulnerability of the Kubeclient::Config implementation for the REST API client of Kubernetes allows for certificate validation process errors. Exploiting this vulnerability could enable a malicious actor to carry out a “man-in-the-middle” attack...

The vulnerability of the kube-apiserver component, which is part of the Kubernetes cluster management software, allows a attacker to compromise data integrity and cause service failures.

The vulnerability of the kube-apiserver component, which is part of the Kubernetes cluster management software, is related to improper authentication. Exploiting this vulnerability allows a remote attacker to compromise data integrity and cause service failures...

A Bootiful Podcast: Kubernetes cofounder and vice president of R&D at VMware, Craig McLuckie

Hi, Spring fans! Welcome to another installment of a Bootiful Podcast! In this episode, Josh Long @starbuxman talks to Kubernetes cofounder, all-around nice person, and vice president of R&D at VMware, Craig McLuckie @cmcluck...

RCE Bug in Spring Cloud Could Be the Next Log4Shell, Researchers Warn

NOTE: This post is about the confirmed and patched vulnerability tracked as CVE-2022-22963. While the researchers at Sysdig refer to this Spring Cloud bug as “Spring4Shell,” it should be noted that there is some confusion as to what to call it, with another security firm referring to a different,...