Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Operator security update

An update is now available for OpenShift-Pipelines-1.11-RHEL-8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

GHSA-Q78C-GWQW-JCMC vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, aws-efs-csi-driver...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips, aws-efs-csi-driver, kubeflow-pipelines...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, aws-efs-csi-driver...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: kpt, aactl, skaffold, tekton-chains, k3d, slsa-verifier, k3s, scorecard, spire-server-fips, ctop, bom, kubescape, chartmuseum, paranoia, up, falcoctl-fips...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines 1.12.1 release and security update

Red Hat OpenShift Pipelines 1.12.1 has been released. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in t...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Client tkn for 1.12.1 release and security update

Red Hat OpenShift Pipelines Client tkn for 1.12.1 has been released. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2023-3361

A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster ds pipeline server and saves them in plain text in the generated output instead of an ID for a Kubernetes secret...

GitLab 13.12 < 16.2.8 / 16.3.0 < 16.3.5 / 16.4.0 < 16.4.1 (CVE-2023-5106)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to...

CVE-2023-5106

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2023-5106

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

Design/Logic Flaw

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2023-5106

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2023-5106 Incorrect Authorization in GitLab

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2023-5106 Incorrect Authorization in GitLab

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2023-5106

Removed by vendor...

CVE-2023-5106 Incorrect Authorization in GitLab

An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports...

CVE-2023-5106

CVE-2023-5106 affects Ultimate-licensed GitLab EE. Versions 13.12–before 16.2.8, 16.3.0–before 16.3.5, and 16.4.0–before 16.4.1 allow an attacker to impersonate users in CI pipelines via direct transfer group imports. The available documents do not specify a confirmed fixed version or patch detai...

PT-2023-31754 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 13.12 through 16.2.8 GitLab EE versions 16.3.0 through 16.3.5 GitLab EE versions 16.4.0 through 16.4.1 Description: An issue has been discovered in Ultimate-licensed GitLab EE that could allow an attacker to impersonate use...

PT-2023-5661 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE and EE versions 16.0 through 16.2.7 GitLab CE and EE versions 16.3 through 16.3.4 GitLab CE and EE versions 16.4 through 16.4.0 Description: A vulnerability was discovered in GitLab CE and EE, affecting the control access mechanism...