107 matches found
Photon OS 5.0: Nerdctl PHSA-2023-5.0-0044
An update of the nerdctl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-0044. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
CVE-2024-28180 vulnerabilities
Vulnerabilities for packages: minio, nerdctl, tkn, oauth2-proxy, slsa-verifier, flux-source-controller, caddy, falcoctl, tekton-chains, gomplate, step-ca, cosign, step, aactl, kots, temporal-ui-server, dex, gitsign, melange, terragrunt, grpc-health-probe, zarf, cloudflared, skaffold, vexctl, sops...
CentOS 9 : runc-1.1.7-1.el9
The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the runc-1.1.7-1.el9 build changelog. - runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless...
Amazon Linux 2023 : nerdctl (ALAS2023-2024-529)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-529 advisory. A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can...
Medium: nerdctl
Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...
Medium: nerdctl
Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...
CVE-2024-21626 vulnerabilities
Vulnerabilities for packages: syft, trivy, skaffold, k3d, kubescape, kaniko, grype, cadvisor, ctop, runc, zot, kubernetes, nerdctl, newrelic-infrastructure-agent, docker, k3s, k9s, wolfictl, zarf, podman, kots, buildkitd, skopeo...
CVE-2024-21626 vulnerabilities
Vulnerabilities for packages: k3d, nerdctl, syft, kots, buildkitd, zarf, skaffold, docker, kubernetes, runc, kubescape, zot, kaniko, grype, newrelic-infrastructure-agent, trivy, podman, k9s, skopeo, wolfictl, k3s, ctop, cadvisor...
Amazon Linux 2 : nerdctl (ALAS-2023-2339)
The version of nerdctl installed on the remote host is prior to 1.6.2-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2339 advisory. 2024-02-01: CVE-2023-3978 was added to this advisory. The HTTP/2 protocol allows a denial of service server resource...
Important: nerdctl
Issue Overview: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-39325 Text nodes not in the HTML namespace are incorrectly literally rendered,...
Medium: nerdctl
Issue Overview: Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Affected Packages: nerdctl Issue Correction: Run dnf update nerdctl --releasever 2023.2.20231002 or dnf update...
Amazon Linux 2023 : nerdctl (ALAS2023-2023-366)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-366 advisory. Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack. CVE-2023-3978 Tenable has extracted the precedi...
Important: nerdctl
Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send...
Amazon Linux 2023 : nerdctl (ALAS2023-2023-313)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-313 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject...
Amazon Linux 2 : nerdctl (ALAS-2023-2210)
The version of nerdctl installed on the remote host is prior to 1.1.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2210 advisory. 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a...
Medium: nerdctl
Issue Overview: 2023-10-11: The severity level was changed from Important to Medium. Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to = 8192...
Amazon Linux 2 : nerdctl (ALAS-2023-2193)
The version of nerdctl installed on the remote host is prior to 1.1.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2193 advisory. http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the...
Important: nerdctl
Issue Overview: http2/hpack: avoid quadratic complexity in hpack decoding CVE-2022-41723 The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send...
