AZL-38761 CVE-2023-45288 affecting package prometheus-adapter for versions less than 0.12.0-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2. A patched version of the package is available...

AZL-35594 CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35671 CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.12.0-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: prometheus-elasticsearch-exporter-fips, dex, wavefront-collector-for-kubernetes, crossplane-provider-aws-kinesis, aws-efs-csi-driver-fips, restic, thanos-operator, configmap-reload-fips, memcached-exporter, prometheus-redis-exporter, kor, terraform-provider-google,...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: spark-operator, kubernetes-dns-node-cache, prometheus-adapter, nodetaint, ip-masq-agent, aws-efs-csi-driver-fips, aws-efs-csi-driver, aws-ebs-csi-driver...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver, prometheus-adapter, ip-masq-agent, spark-operator, nodetaint, kubernetes-dns-node-cache...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: spark-operator, kubernetes-dns-node-cache, prometheus-adapter, nodetaint, ip-masq-agent, aws-efs-csi-driver-fips, aws-efs-csi-driver, aws-ebs-csi-driver...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow, kubevela, k3d, cortex, terraform-provider-sendgrid, kubescape, dgraph, prometheus-blackbox-exporter, spark-operator, src, scorecard, slsa-verifier, aactl, up, buildkitd...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, slsa-verifier, kiam, volume-modifier-for-k8s-fips, prometheus-stackdriver-exporter, up, metrics-server-fips, aws-efs-csi-driver-fips, terraform-provider-sendgrid-fips, smarter-device-manager-fips, k3d, kube-oidc-proxy, buildkitd, kubescap...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: k3s, kube-oidc-proxy, buildkitd, prometheus-adapter, kubevela, kubernetes-fips, up, metrics-server-fips, rancher-webhook, caddy, rancher-webhook-fips, kubernetes...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: kubevela, kubernetes, prometheus-adapter, caddy, k3s, up, buildkitd...

AZL-35121 CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: skaffold, prometheus-adapter, ip-masq-agent, pulumi-language-dotnet, gomplate, nri-prometheus, scorecard, pulumi-language-yaml, kubevela, kubernetes-csi-livenessprobe, flux-source-controller, helm, gobuster, nats, bom, aactl, aws-efs-csi-driver, dex, kubeflow, grype,...

AZL-35117 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-31342 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35120 CVE-2023-3978 affecting package prometheus-adapter for versions less than 0.12.0-1

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2. A patched version of the package is available...

AZL-25938 CVE-2022-3162 affecting package prometheus-adapter for versions less than 0.10.0-17

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-33632 CVE-2022-32149 affecting package prometheus-adapter for versions less than 0.10.0-14

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse...