PT-2023-32468 · Yugabyte · Yugabytedb Anywhere

Name of the Vulnerable Software and Affected Versions: YugabyteDB Anywhere affected versions not specified Description: The issue concerns Prometheus metrics being available without authentication, exposing detailed and sensitive information about the YugabyteDB Anywhere environment...

Fedora 39 : golang-github-prometheus-alertmanager (2023-0c6723004f)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-0c6723004f advisory. Automatic update for golang-github-prometheus-alertmanager-0.23.0-15.fc39. Changelog Sat Apr 29 2023 Srgio M. Basto - 0.23.0-15 - Include s390x, and disable...

Fedora 39 : golang-github-prometheus-exporter-toolkit / etc (2023-cf176d02d8)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-cf176d02d8 advisory. Security fix for CVE-2022-46146, update to v0.10.0 Tenable has extracted the preceding description block directly from the Fedora security advisory...

Rocky Linux 8 : prometheus-jmx-exporter (RLSA-2020:4807)

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2020:4807 advisory. - The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564. CVE-2017-18640 Note that Nessus h...

CVE-2023-38994

The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...

Default configuration

The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...

PT-2023-7018 · Univention · Univention Corporate Server

Name of the Vulnerable Software and Affected Versions: Univention Corporate Server UCS versions 5.0-5 Description: The issue is related to the check univention joinstatus prometheus monitoring script, which reveals the LDAP plaintext password of the machine account in the process list. This allow...

CVE-2023-38994

The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: k3s, up, spire-server-fips, k3d, skaffold, tekton-chains, kpt, bom, paranoia, ctop, chartmuseum, slsa-verifier, kubescape, scorecard, aactl, falcoctl-fips...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, vault-csi-provider, dynamic-localpv-provisioner-fips, up, buildkitd, prometheus-stackdriver-exporter, conftest-fips, slsa-verifier, kubescape, dgraph, volume-modifier-for-k8s-fips, terraform-provider-sendgrid-fips, kube-oidc-proxy, src,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aactl, buildkitd, scorecard, src, terraform-provider-sendgrid, k3d, up, kubevela, spark-operator, cortex, kubescape, dgraph, slsa-verifier, kubeflow...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: k3s, prometheus-adapter, kubevela, up, buildkitd, caddy, rancher-webhook-fips, kubernetes, rancher-webhook, metrics-server-fips, kubernetes-fips, kube-oidc-proxy...

OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics

Summary This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.goL63-L65 out of the box adds labels - http.useragent - http.method that have unbound cardinality. It leads to the server...

Grafana Security Vulnerabilities

Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus. Grafana has a security vulnerability. An attacker can exploit the vulnerability to elevate privileges...

CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10

CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10. A patched version of the package is available...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: k3s, prometheus-adapter, kubevela, up, buildkitd, caddy, rancher-webhook-fips, kubernetes, rancher-webhook, metrics-server-fips, kubernetes-fips, kube-oidc-proxy...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: caddy, buildkitd, prometheus-adapter, up, kubevela, kubernetes, k3s...

AZL-35116 CVE-2023-45142 affecting package prometheus for versions less than 2.45.4-1

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, git-lfs, wavefront-collector-for-kubernetes, atlantis, k8sgpt-operator, metacontroller, vault-k8s, hey, prometheus-operator, haproxy-ingress, gitness, nodetaint, buildkitd, prometheus-stackdriver-exporter, kubernetes-dashboard, pulumi, runc,...

AZL-50339 CVE-2023-39325 affecting package prometheus for versions less than 2.37.9-2

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...