CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: terragrunt, crossplane, osv-scanner, crossplane-provider-aws-iam, trillian, node-problem-detector, kuberay-operator, nri-prometheus, prometheus-statsd-exporter-fips, supercronic, fulcio-fips, cass-operator, etcd, crossplane-provider-aws-s3, minio,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: direnv, argo-workflows, docker-credential-acr-env, gobuster, sonobuoy, kubernetes-csi-livenessprobe, kubernetes-dashboard-metrics-scraper, kyverno-policy-reporter, speedtest-go, timoni, shfmt, aws-efs-csi-driver, aws-load-balancer-controller,...

AZL-37119 CVE-2024-24786 affecting package node-problem-detector for versions less than 0.8.17-2

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2021-44716 affecting package node-problem-detector for versions less than 0.8.10-20

CVE-2021-44716 affecting package node-problem-detector for versions less than 0.8.10-20. A patched version of the package is available...

CVE-2022-21698 affecting package node-problem-detector for versions less than 0.8.10-19

CVE-2022-21698 affecting package node-problem-detector for versions less than 0.8.10-19. A patched version of the package is available...

AZL-35443 CVE-2023-48795 affecting package node-problem-detector for versions less than 0.8.20-2

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted from the extension negotiation message, and a client and server may consequently end up with a connecti...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow, src, dgraph, cortex, aactl, k3d, up, kubescape, terraform-provider-sendgrid, slsa-verifier, buildkitd, scorecard, kubevela, spark-operator...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips, conftest-fips, vault-csi-provider, up, slsa-verifier, spark-operator, kubescape, cortex, kubevela, prometheus-blackbox-exporter, metrics-server-fips, kubernetes-csi-livenessprobe, bank-vaults-fips, terraform-provider-sendgrid, aactl, scorecar...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: nginx-stable, gobuster, kubernetes-csi-livenessprobe, oauth2-proxy, aws-efs-csi-driver, kubescape, git-lfs, slsa-verifier, envoy-ratelimit, certificate-transparency, src, terraform-provider-aws, kubeflow-katib, helm, metacontroller, nghttp2, scorecard, kubevela,...

AZL-31336 CVE-2023-44487 affecting package node-problem-detector for versions less than 0.8.10-16

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35038 CVE-2023-44487 affecting package node-problem-detector for versions less than 0.8.10-16

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-33628 CVE-2022-32149 affecting package node-problem-detector for versions less than 0.8.17-2

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...

AZL-35041 CVE-2022-32149 affecting package node-problem-detector for versions less than 0.8.15-1

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...

AZL-35039 CVE-2022-29526 affecting package node-problem-detector for versions less than 0.8.15-1

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible...

AZL-35040 CVE-2022-21698 affecting package node-problem-detector for versions less than 0.8.15-1

clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients. In clientgolang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and...

AZL-33626 CVE-2022-21698 affecting package node-problem-detector for versions less than 0.8.10-19

clientgolang is the instrumentation library for Go applications in Prometheus, and the promhttp package in clientgolang provides tooling around HTTP servers and clients. In clientgolang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and...

AZL-33627 CVE-2021-44716 affecting package node-problem-detector for versions less than 0.8.10-20

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...

AZL-35037 CVE-2021-44716 affecting package node-problem-detector for versions less than 0.8.15-1

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...