CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12

CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12. A patched version of the package is available...

AZL-38761 CVE-2023-45288 affecting package prometheus-adapter for versions less than 0.12.0-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2. A patched version of the package is available...

AZL-35594 CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.10.0-12

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

AZL-35671 CVE-2024-24786 affecting package prometheus-adapter for versions less than 0.12.0-1

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, flux-helm-controller, grafana-agent-operator, crossplane-provider-aws-firehose, kube-logging-logging-operator, prometheus-operator-fips, kubeflow, boring-registry, external-secrets-fips, osv-scanner, crossplane-provider-aws, timestamp-authorit...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: prometheus-adapter, nodetaint, aws-efs-csi-driver, kubernetes-dns-node-cache, aws-efs-csi-driver-fips, spark-operator, ip-masq-agent, aws-ebs-csi-driver...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: kubernetes-dns-node-cache, spark-operator, aws-efs-csi-driver, nodetaint, ip-masq-agent, prometheus-adapter...

CVE-2023-5528 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, nodetaint, aws-efs-csi-driver, kubernetes-dns-node-cache, aws-efs-csi-driver-fips, spark-operator, ip-masq-agent, aws-ebs-csi-driver...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: smarter-device-manager-fips, buildkitd, kubernetes-csi-livenessprobe-fips, prometheus-stackdriver-exporter, terraform-provider-sendgrid-fips, kubevela, bank-vaults-fips, spark-operator, terraform-provider-sendgrid, dgraph, kubeflow, metrics-server-fips, cortex,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow, scorecard, src, spark-operator, buildkitd, k3d, up, kubevela, dgraph, slsa-verifier, cortex, terraform-provider-sendgrid, aactl, kubescape...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: buildkitd, up, kubevela, k3s, kubernetes, caddy, prometheus-adapter...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: buildkitd, caddy, prometheus-adapter, rancher-webhook, up, kubevela, rancher-webhook-fips, kubernetes-fips, k3s, kube-oidc-proxy, kubernetes, metrics-server-fips...

AZL-35121 CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: scorecard, hey, grpcurl, grype, dynamic-localpv-provisioner, ko, ollama, aactl, memcached-exporter, k3d, atlantis, nginx-stable, kubeflow-katib, git-lfs, rqlite, stakater-reloader, gobuster, mc, certificate-transparency, hugo, frp, gomplate, secrets-store-csi-driver,...

AZL-35117 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-31342 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35120 CVE-2023-3978 affecting package prometheus-adapter for versions less than 0.12.0-1

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack...

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2. A patched version of the package is available...

AZL-25938 CVE-2022-3162 affecting package prometheus-adapter for versions less than 0.10.0-17

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...