etcd having a negative value for cluster node size results in an index out-of-bound panic during service discovery

Vulnerability type Data Validation Detail When an etcd instance attempts to perform service discovery, if a cluster size is provided as a negative value, the etcd instance will panic without recovery. References Find out more on this vulnerability in the security audit report For more information...

etcd's WAL `ReadAll` method vulnerable to an entry with large index causing panic

Vulnerability type Data Validation Detail In the ReadAll method in wal/wal.go, it is possible to have an entry index greater then the number of entries. This could cause issues when WAL entries are being read during consensus as an arbitrary etcd consensus participant could go down from a runtime...

PT-2022-28228 · Etcd · Etcd

Name of the Vulnerable Software and Affected Versions: etcd affected versions not specified Description: The issue occurs when an etcd instance attempts to perform service discovery and a cluster size is provided as a negative value, causing the etcd instance to panic without recovery...

Ubuntu 22.04 LTS : Linux kernel (Oracle) vulnerabilities (USN-5640-1)

The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5640-1 advisory. It was discovered that the framebuffer driver on the Linux kernel did not verify size limits when changing font or screen size, leading to an out-of-...

OESA-2022-1941 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: A flaw was found in the sctpmakestrresetreq function in net/sctp/smmakechunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated...

Ubuntu 20.04 LTS : etcd vulnerabilities (USN-5628-1)

The remote Ubuntu 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5628-1 advisory. It was discovered that etcd incorrectly handled certain specially crafted WAL files. An attacker could possibly use this issue to cause a denial of...

GO-2022-1002 Panic in github.com/pandatix/go-cvss

ParseVector can panic when provided with invalid input...

GSD-2022-1005563 sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed

sched, cpuset: Fix dlcpubusy panic due to empty cs-cpusallowed This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit...

PT-2022-34084 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.137 Description: The issue is related to a potential panic in the dl cpu busy function due to an empty cs-cpus allowed. The actual impact and attack plausibility have not yet been proven. Recommendations:...

GHSA-P2G7-XWVR-RRW3 Helm Controller denial of service

Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK allows for specific data inputs to cause high memory consumption, which in some platforms could cause the controller to panic and stop processing reconciliations. Impact In a shared cluster multi-tenanc...

CVE-2020-36601

Out-of-bounds write vulnerability in the kernel modules. Successful exploitation of this vulnerability may cause a panic reboot...

CVE-2020-36601

Out-of-bounds write vulnerability in the kernel modules. Successful exploitation of this vulnerability may cause a panic reboot...

Cross site scripting

Out-of-bounds write vulnerability in the kernel modules. Successful exploitation of this vulnerability may cause a panic reboot...

CVE-2020-36601

Out-of-bounds write vulnerability in the kernel modules. Successful exploitation of this vulnerability may cause a panic reboot...

CVE-2020-36601

CVE-2020-36601 is described as an out-of-bounds write vulnerability in kernel modules that may trigger a panic reboot on successful exploitation. The available connected records reiterate the kernel-level write issue and its impact, but do not specify concrete vulnerable products, versions, explo...

Denial Of Service (DoS)

github.com/pandatix/go-cvss is vulnerable to denial of service DoS attacks. A remote attacker is able to cause a system panic, when a full CVSS v2.0 vector string is parsed through the ParseVector function, which leads to an out-of-bounds read causing the system hang...

PT-2022-33461 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to a potential panic in the dl cpu busy function due to an empty cs-cpus allowed. The actual impact and attack plausibility have not yet been proven. Recommendations: Fo...

Go-CVSS 缓冲区错误漏洞

Go-CVSS is a low-allocation Go module from the Lucas TESSON personal developer. It is used to operate the Common Vulnerability Scoring System CVSS. A buffer error vulnerability exists in Go-CVSS versions prior to v0.4.0, which stems from a potential out-of-bounds read due to lack of testing when...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2022-2317)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP9 : golang (EulerOS-SA-2022-2288)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In Go before 1.13.13 and 1.14.x before 1.14.5, Certificate.Verify may lack a check on the VerifyOptions.KeyUsages EKU requirements if...