GHSA-CQ38-JH5F-37MQ vulnerabilities

Vulnerabilities for packages: cosign, gh, slsa-verifier...

GHSA-CQ38-JH5F-37MQ vulnerabilities

Vulnerabilities for packages: cosign-fips, slsa-verifier, cosign, gh...

GO-2023-2188 slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier

slsa-verifier vulnerable to mproper validation of npm's publish attestations in github.com/slsa-framework/slsa-verifier...

GHSA-R2XV-VPR2-42M9 slsa-verifier vulnerable to mproper validation of npm's publish attestations

Summary slsa-verifier attestationstampered.json 5. SLSAVERIFIEREXPERIMENTAL=1 slsa-verifier verify-npm-package supreme-goggles.tgz --attestations-path attestationstampered.json --builder-id "https://github.com/actions/runner/github-hosted" --package-name "@trishankatdatadog/supreme-goggles"...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: tekton-chains, bom, chartmuseum, kpt, skaffold, rancher-agent, k3d, slsa-verifier, falco, ctop, spire-server-fips, cert-manager, scorecard, kubescape, k3s, aactl, paranoia, falcoctl-fips, up...

Google Expands Its Bug Bounty Program to Tackle Artificial Intelligence Threats

Google has announced that it's expanding its Vulnerability Rewards Program VRP to compensate researchers for finding attack scenarios tailored to generative artificial intelligence AI systems in an effort to bolster AI safety and security. "Generative AI raises new and different concerns than...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: timestamp-authority-fips, dynamic-localpv-provisioner-fips, aws-efs-csi-driver-fips, prometheus-adapter-fips, spark-operator, conftest-fips, k3d, falco, slsa-verifier, kubeflow-fips, cluster-autoscaler-fips, kubevela, scorecard, kubernetes-csi-livenessprobe, kubescap...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubescape, kubevela, dgraph, cortex, spark-operator, src, aactl, terraform-provider-sendgrid, buildkitd, slsa-verifier, up, prometheus-blackbox-exporter, kubeflow, k3d, scorecard, falco...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: cue, haproxy-ingress, flux-kustomize-controller, bom, prometheus-mongodb-exporter, aws-efs-csi-driver-fips, flux-image-reflector-controller, pulumi-language-java, kube-state-metrics-fips, runc, prometheus-node-exporter, prometheus-postgres-exporter, falco, kubevela,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: dex, weaviate, conftest, prometheus-adapter, gitness, secrets-store-csi-driver, stakater-reloader, amass, cosign, ollama, k3d, fuse-overlayfs-snapshotter, kubewatch, buildkitd, kpt, flux-notification-controller, pulumi, kots, scorecard, flux-kustomize-controller,...

CVE-2023-37264

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

Pipelines do not validate child UIDs

Summary Pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child Task. We should add UID to PipelineRun status and validate that child Run status/results only come from Runs...

CVE-2023-37264

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

Design/Logic Flaw

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

CVE-2023-37264 Pipelines do not validate child UIDs

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

CVE-2023-37264 Pipelines do not validate child UIDs

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

PT-2023-25868 · Unknown · Tekton Pipelines

Name of the Vulnerable Software and Affected Versions: Tekton Pipelines versions 0.35.0 and later Description: The Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user...

GUAC 0.1 Beta: Google's Breakthrough Framework for Secure Software Supply Chains

Google on Wednesday announced the 0.1 Beta version of GUAC short for Graph for Understanding Artifact Composition for organizations to secure their software supply chains. To that end, the search giant is making available the open source framework as an API for developers to integrate their own...

Scientific Linux Security Update : zlib on SL7.x i686/x86_64 (2023:1095)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2023:1095-1 advisory. - zlib: heap-based buffer over-read and overflow in inflate in inflate.c via a large gzip header extra field CVE-2022-37434 Note that Nessus has not teste...

Scientific Linux Security Update : samba on SL7.x i686/x86_64 (2023:1090)

The remote Scientific Linux 7 host has packages installed that are affected by a vulnerability as referenced in the SLSA-2023:1090-1 advisory. - samba: RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided CVE-2022-38023 Note that Nessus has not tested for this issue but has instead...