341 matches found
BIT-MOODLE-2023-5548 Moodle: cache poisoning risk with endpoint revision numbers
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
DEBIAN-CVE-2024-23334
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...
AZL-44319 CVE-2024-23334 affecting package python-aiohttp 3.6.2-3
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...
The vulnerability of the Knative Serving deployment and application management tool, related to uncontrolled resource consumption, allows a attacker to cause service failures.
The vulnerability of the Knative Serving deployment and application management tool is related to an uncontrolled resource consumption when processing endpoints in the /metrics directory. Exploiting this vulnerability could allow a malicious actor to cause service failures...
CVE-2023-48713
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
Design/Logic Flaw
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713
Knative Serving (on Kubernetes) contains a DoS flaw (CVE-2023-48713) caused by an unbound memory allocation in the /metrics response. If an attacker controls a pod sufficiently to influence its responses, they can trigger a denial of service in the autoscaler. The issue is specific to the metrics...
CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
CVE-2023-48713 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Knative Serving builds on Kubernetes to support deploying and serving of applications and functions as serverless containers. An attacker who controls a pod to a degree where they can control the responses from the /metrics endpoint can cause Denial-of-Service of the autoscaler from an unbound...
Knative Serving Security Vulnerability
Knative Serving is a Kubernetes-based build from Knative that supports the deployment and servicing of applications and features as serverless containers. A security vulnerability exists in Knative Serving that stems from a memory allocation error, which could lead to a denial of service by an...
GHSA-QMVJ-4QR9-V547 Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Summary A vulnerability was fond in Knative Serving that could allow an attacker to crash the Knative Serving autoscaler resulting in a denial of service. The attacker would need to have compromised one pod in the Knative Serving deployment, and with that position they could launch the attack...
Knative Serving vulnerable to attacker-controlled pod causing denial of service of autoscaler
Summary A vulnerability was fond in Knative Serving that could allow an attacker to crash the Knative Serving autoscaler resulting in a denial of service. The attacker would need to have compromised one pod in the Knative Serving deployment, and with that position they could launch the attack...
CVE-2023-48299
CVE-2023-48299 (TorchServe ZipSlip) affects TorchServe versions 0.1.0 through 0.9.0 via the model/workflow management API, where uploading archives could cause files to be extracted to any location within process permissions. The underlying issue is unvalidated ZIP file paths, enabling potential ...
Cache Poisoning
moodle/moodle is vulnerable to Cache Poisoning. The vulnerability exists because the library does not impose any restrictions on the minimum value for a revision. If the revision is either too old or too new, the file content is cached without undergoing any validation through the file serving...
Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
GHSA-CWH2-Q44X-5W3C Moodle Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
CVE-2023-5548
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection...
