AZL-38761 CVE-2023-45288 affecting package prometheus-adapter for versions less than 0.12.0-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2. A patched version of the package is available...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, cadvisor, actions-runner-controller, dynamic-localpv-provisioner, zot, vexctl, pgpool2exporter-fips, capslock, prometheus-operator, terraform-docs, dagger, flux-source-controller, prometheus-statsd-exporter-fips, metrics-server,...

AZL-35671 CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.12.0-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35594 CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver, aws-efs-csi-driver, prometheus-adapter, ip-masq-agent, aws-efs-csi-driver-fips, spark-operator, cluster-autoscaler-fips, kubernetes-dns-node-cache, nodetaint...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: ip-masq-agent, nodetaint, aws-efs-csi-driver, spark-operator, prometheus-adapter, kubernetes-dns-node-cache...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: aws-ebs-csi-driver, aws-efs-csi-driver, prometheus-adapter, ip-masq-agent, aws-efs-csi-driver-fips, spark-operator, cluster-autoscaler-fips, kubernetes-dns-node-cache, nodetaint...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: src, buildkitd, prometheus-blackbox-exporter, falco, cortex, scorecard, kubeflow, kubescape, slsa-verifier, kubevela, k3d, terraform-provider-sendgrid, aactl, up, spark-operator, dgraph...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, kubescape, vault-csi-provider, metrics-server-fips, k3d, aws-efs-csi-driver-fips, kube-oidc-proxy, terraform-provider-sendgrid-fips, bank-vaults-fips, terraform-provider-sendgrid, volume-modifier-for-k8s-fips, kubernetes-csi-livenessprobe-fip...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: buildkitd, kubernetes, caddy, kubevela, k3s, prometheus-adapter, up...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: buildkitd, prometheus-adapter, metrics-server-fips, kubevela, k3s, kube-oidc-proxy, cert-manager, kubernetes, up, rancher-webhook, rancher-webhook-fips, kubernetes-fips, caddy...

AZL-35121 CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, cue, kpt, dgraph, amass, nodetaint, kubescape, pulumi, mc, fuse-overlayfs-snapshotter, spark-operator, stakater-reloader, grpcurl, terraform, slsa-verifier, flux-kustomize-controller, node-problem-detector, cosign, pulumi-kubernetes-operator, gobuster,...

AZL-35117 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-31342 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35120 CVE-2023-3978 affecting package prometheus-adapter for versions less than 0.12.0-1

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2. A patched version of the package is available...

AZL-25938 CVE-2022-3162 affecting package prometheus-adapter for versions less than 0.10.0-17

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-33632 CVE-2022-32149 affecting package prometheus-adapter for versions less than 0.10.0-14

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...