CVE-2023-49290 vulnerabilities

Vulnerabilities for packages: gitsign, falcoctl, kubescape, falcoctl-fips, cosign-fips, tekton-chains, vexctl...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: spire-server-fips, tkn, fulcio, kubescape, falcoctl-fips, flux-source-controller, oauth2-proxy, kots, timestamp-authority-fips, vexctl, cosign-fips, gitsign, dex, flux-kustomize-controller, aactl, tekton-chains, terragrunt, fulcio-fips, bank-vaults-fips, spire-server...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: spire-server, rekor, sops, tkn, gitsign, flux-source-controller, kots, cosign, vexctl, terragrunt, fulcio, dex, oauth2-proxy, kubescape, argo-workflows, aactl, flux-kustomize-controller, tekton-chains, cloudflared, slsa-verifier...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: spire-server-fips, policy-controller, tkn, kubescape, spire-server, falcoctl-fips, flux-source-controller, cosign, skaffold, tekton-chains, melange, aactl, ko, slsa-verifier, apko...

GHSA-VFP6-JRW2-99G9 vulnerabilities

Vulnerabilities for packages: spire-server, apko, kubescape, aactl, ko, policy-controller, cosign, skaffold, tkn, tekton-chains, melange, slsa-verifier, flux-source-controller...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines Operator security update

An update is now available for OpenShift-Pipelines-1.11-RHEL-8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: spire-server, apko, kubescape, aactl, ko, policy-controller, cosign, skaffold, tkn, tekton-chains, melange, slsa-verifier, flux-source-controller...

CVE-2023-46737 vulnerabilities

Vulnerabilities for packages: spire-server-fips, policy-controller, tkn, kubescape, spire-server, falcoctl-fips, flux-source-controller, cosign, skaffold, tekton-chains, melange, aactl, ko, slsa-verifier, apko...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: chartmuseum, k3d, spire-server-fips, scorecard, kubescape, up, falcoctl-fips, kpt, paranoia, skaffold, tekton-chains, bom, aactl, k3s, slsa-verifier, ctop...

Important: Red Hat Security Advisory: Red Hat OpenShift Pipelines 1.12.1 release and security update

Red Hat OpenShift Pipelines 1.12.1 has been released. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in t...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-resizer, prometheus-elasticsearch-exporter-fips, gke-gcloud-auth-plugin, prometheus-node-exporter, terraform, flux-source-controller, aws-load-balancer-controller, nodetaint, trust-manager, k8sgpt-operator, atlantis-fips,...

CVE-2023-37264

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

Important: Red Hat Bug Fix Advisory: Red Hat OpenShift Pipelines 1.10.5 release

Red Hat OpenShift Pipelines 1.10.5 General Availability release - A cloud-native Continuous Integration and Delivery solution on OpenShift. Red Hat OpenShift Pipelines is a cloud-native continuous integration and delivery CI/CD solution for building pipelines using Tekton. Tekton is a flexible,...

CVE-2023-37264

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

Design/Logic Flaw

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

CVE-2023-37264 Pipelines do not validate child UIDs

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

CVE-2023-37264

CVE-2023-37264 affects Tekton Pipelines: starting from 0.35.0, the Pipelines controller does not validate child TaskRun UIDs, allowing a user who can create TaskRuns to subvert ownership checks by creating a child TaskRun with the same name/owner reference. This can lead to the Pipeline controlle...

CVE-2023-37264 Pipelines do not validate child UIDs

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

CVE-2023-37264 Pipelines do not validate child UIDs

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user that has access to create TaskRuns can create their own Tasks that the Pipelines controller will accept as the child...

PT-2023-25868 · Unknown · Tekton Pipelines

Name of the Vulnerable Software and Affected Versions: Tekton Pipelines versions 0.35.0 and later Description: The Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 0.35.0, pipelines do not validate child UIDs, which means that a user...