GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubernetes-csi-livenessprobe, terraform-provider-sendgrid-fips, kiam, scorecard, falcoctl-fips, kubescape, up, src, kubeflow, metrics-server-fips, dynamic-localpv-provisioner-fips, aws-efs-csi-driver-fips, kube-oidc-proxy, prometheus-blackbox-exporter, conftest-fips,...

OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics

Summary This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.goL63-L65 out of the box adds labels - http.useragent - http.method that have unbound cardinality. It leads to the server...

GHSA-RCJV-MGP8-QVMR vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, kubernetes, prometheus-adapter, kubevela, rancher-webhook-fips, k3s, up, rancher-webhook, kubernetes-fips, buildkitd, caddy, metrics-server-fips...

Grafana Security Vulnerabilities

Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus. Grafana has a security vulnerability. An attacker can exploit the vulnerability to elevate privileges...

CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10

CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10. A patched version of the package is available...

AZL-35116 CVE-2023-45142 affecting package prometheus for versions less than 2.45.4-1

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: caddy, kubevela, up, buildkitd, prometheus-adapter, kubernetes, k3s...

CVE-2023-45142 vulnerabilities

Vulnerabilities for packages: kube-oidc-proxy, kubernetes, prometheus-adapter, kubevela, rancher-webhook-fips, k3s, up, rancher-webhook, kubernetes-fips, buildkitd, caddy, metrics-server-fips...

AZL-35121 CVE-2023-39325 affecting package prometheus-adapter for versions less than 0.12.0-1

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

AZL-50339 CVE-2023-39325 affecting package prometheus for versions less than 2.37.9-2

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: weaviate, crossplane-provider-aws, cosign, kiam, nodetaint, gitness, nri-prometheus, prometheus-node-exporter-fips, wavefront-collector-for-kubernetes, kpt, kube-oidc-proxy, kube-state-metrics-fips, dive, terraform-provider-sendgrid, memcached-exporter,...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: nodetaint, prometheus-adapter, flux-notification-controller, vertical-pod-autoscaler, kpt, k8sgpt-operator, kube-logging-operator, k3d, trust-manager, metrics-server, nfs-subdir-external-provisioner, secrets-store-csi-driver-provider-gcp, kubernetes-dashboard, grpcur...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: weaviate, crossplane-provider-aws, cosign, kiam, nodetaint, gitness, nri-prometheus, prometheus-node-exporter-fips, wavefront-collector-for-kubernetes, kpt, kube-oidc-proxy, kube-state-metrics-fips, dive, terraform-provider-sendgrid, memcached-exporter,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: weaviate, kiam, cosign, nodetaint, scorecard, gitness, nri-prometheus, kpt, kube-oidc-proxy, terraform-provider-sendgrid, memcached-exporter, prometheus-stackdriver-exporter, terraform, tomcat, hey, kots, configmap-reload-fips, git-lfs, slsa-verifier, dex, kind,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: nodetaint, prometheus-adapter, flux-notification-controller, kpt, k3d, metrics-server, secrets-store-csi-driver-provider-gcp, cortex, nghttp2, grpcurl, pulumi-kubernetes-operator, flux-source-controller, metacontroller, pulumi-language-dotnet, mc, stakater-reloader,...

AZL-31341 CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35117 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35114 CVE-2023-44487 affecting package prometheus for versions less than 2.37.0-10

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-31342 CVE-2023-44487 affecting package prometheus-adapter for versions less than 0.10.0-2

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: nodetaint, prometheus-adapter, flux-notification-controller, kpt, k3d, metrics-server, secrets-store-csi-driver-provider-gcp, cortex, nghttp2, grpcurl, pulumi-kubernetes-operator, flux-source-controller, metacontroller, pulumi-language-dotnet, mc, stakater-reloader,...