Azure Linux 3.0 Security Update: kubernetes / local-path-provisioner (CVE-2020-8565)

The version of kubernetes / local-path-provisioner installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2020-8565 advisory. - In Kubernetes, if the logging level is set to at least 9, authorization and bear...

CVE-2020-8565 affecting package local-path-provisioner for versions less than 0.0.24-5

CVE-2020-8565 affecting package local-path-provisioner for versions less than 0.0.24-5. A patched version of the package is available...

CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12

CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12. A patched version of the package is available...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: thanos, vite, pulumi-language-yaml, wazero, k3s, wire-go, capslock, k8sgpt-operator, task, kubernetes-event-exporter, aws-load-balancer-controller, kpt, nri-cassandra, aws-efs-csi-driver, aws-flb-kinesis, php-fpmexporter, buildkitd, controller-gen, kube-rbac-proxy,...

CVE-2023-39325 affecting package local-path-provisioner for versions less than 0.0.24-3

CVE-2023-39325 affecting package local-path-provisioner for versions less than 0.0.24-3. A patched version of the package is available...

CVE-2023-45288 affecting package local-path-provisioner for versions less than 0.0.24-3

CVE-2023-45288 affecting package local-path-provisioner for versions less than 0.0.24-3. A patched version of the package is available...

GHSA-82M2-CV7P-4M75 vulnerabilities

Vulnerabilities for packages: cri-tools, argocd-image-updater, ip-masq-agent, nodetaint, aws-efs-csi-driver, k8s-device-plugin, local-static-provisioner, kubeflow-pipelines, kubernetes-dns-node-cache, spark-operator, kubernetes-csi-driver-hostpath...

CVE-2024-5321 vulnerabilities

Vulnerabilities for packages: cri-tools, argocd-image-updater, ip-masq-agent, nodetaint, aws-efs-csi-driver, k8s-device-plugin, local-static-provisioner, kubeflow-pipelines, kubernetes-dns-node-cache, spark-operator, kubernetes-csi-driver-hostpath...

Backup Failing With `Too many snapshots` When Using Longhorn as a Storage Provisioner

Challenge Veeam Kasten for Kubernetes backup action for longhorn volumes fails with the error message: too many snapshots created Cause When integrating with CSI-based volumes, Veeam Kasten for Kubernetes employs VolumeSnapshot resources to create snapshots during backup operations. With Longhorn...

Sensitive Information leak via Log File in Kubernetes

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects v1.19.3, v1.18.10, v1.17.13...

AZL-38488 CVE-2023-45288 affecting package local-path-provisioner for versions less than 0.0.24-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-firehose, crossplane-provider-aws-route53, crossplane-provider-family-aws, thanos, pulumi-language-yaml, k3s, capslock, crossplane-provider-aws-eks, crossplane-provider-aws-rds, flannel, k8sgpt-operator, terraform-provider-sendgrid,...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: prometheus-adapter-fips, kubernetes-csi-external-provisioner, tflint, newrelic-infra-operator, falcoctl-fips, kyverno-policy-reporter, prometheus-pushgateway, gomplate, grpcurl, nats, php-fpmexporter, cosign-fips, pulumi-kubernetes-operator, request-1279,...

CVE-2022-21698 affecting package local-path-provisioner for versions less than 0.0.21-14

CVE-2022-21698 affecting package local-path-provisioner for versions less than 0.0.21-14. A patched version of the package is available...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubeflow, prometheus-adapter-fips, kubevela, kubernetes-csi-livenessprobe-fips, volume-modifier-for-k8s-fips, plutono-fips, conftest-fips, metrics-server-fips, aactl, dynamic-localpv-provisioner-fips, kubescape, k3d, dgraph, terraform-provider-sendgrid-fips, up,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: cortex, terraform-provider-sendgrid, src, dgraph, kubeflow, spark-operator, kubevela, buildkitd, aactl, slsa-verifier, kubescape, up, scorecard, k3d...

AZL-34963 CVE-2023-39325 affecting package local-path-provisioner for versions less than 0.0.24-3

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: kubeflow, frp, prometheus-adapter-fips, secrets-store-csi-driver-provider-gcp, kubernetes-csi-external-provisioner, volume-modifier-for-k8s-fips, go, bank-vaults, metrics-server-fips, mc, metrics-server, hey, bom, dgraph, terraform-provider-sendgrid-fips,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, terraform-provider-sendgrid, kpt, aws-efs-csi-driver, buildkitd, wireguard-go, grype, terraform, oauth2-proxy, gobuster, skaffold, flux-notification-controller, ip-masq-agent, nodetaint, src, certificate-transparency, amass, cosign, frp,...

AZL-34964 CVE-2023-44487 affecting package local-path-provisioner for versions less than 0.0.21-12

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...