CVE-2024-24788 vulnerabilities

Vulnerabilities for packages: ghaudit, kube-bench, helm, newrelic-infra-operator, secrets-store-csi-driver-provider-azure, conftest-fips, conftest, dynamic-localpv-provisioner, nats-server, crossplane-provider-aws, karpenter, bom, cosign, go-md2man, croc, falcoctl, neuvector-scanner, dask-gateway...

CVE-2023-3978 affecting package telegraf for versions less than 1.29.4-1

CVE-2023-3978 affecting package telegraf for versions less than 1.29.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-2816 affecting package telegraf for versions less than 1.29.4-1

CVE-2023-2816 affecting package telegraf for versions less than 1.29.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-50658 affecting package telegraf for versions less than 1.29.4-1

CVE-2023-50658 affecting package telegraf for versions less than 1.29.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-46129 affecting package telegraf for versions less than 1.29.4-1

CVE-2023-46129 affecting package telegraf for versions less than 1.29.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-47090 affecting package telegraf for versions less than 1.29.4-1

CVE-2023-47090 affecting package telegraf for versions less than 1.29.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-50658 affecting package telegraf for versions less than 1.29.4-1

CVE-2023-50658 affecting package telegraf for versions less than 1.29.4-1. An upgraded version of the package is available that resolves this issue...

AZL-39514 CVE-2023-45288 affecting package telegraf for versions less than 1.29.4-3

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

AZL-38431 CVE-2023-45288 affecting package telegraf for versions less than 1.31.0-1

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no...

CVE-2024-27304 affecting package telegraf for versions less than 1.28.5-5

CVE-2024-27304 affecting package telegraf for versions less than 1.28.5-5. A patched version of the package is available...

CVE-2024-28110 affecting package telegraf for versions less than 1.28.5-5

CVE-2024-28110 affecting package telegraf for versions less than 1.28.5-5. A patched version of the package is available...

CVE-2024-29018 vulnerabilities

Vulnerabilities for packages: ko, cilium-cli, conftest-fips, conftest, trivy, grype, crossplane, up, wolfictl, cadvisor, buildkitd, syft, prometheus, kargo, kaniko, ctop, docker-compose, zot, loki, cadvisor-fips, spire-server, kubescape, spire-server-fips, buf, tkn, dagger, melange, aactl...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: ko, cilium-cli, conftest-fips, conftest, trivy, grype, crossplane, up, wolfictl, cadvisor, buildkitd, syft, prometheus, kargo, kaniko, ctop, docker-compose, zot, loki, cadvisor-fips, spire-server, kubescape, spire-server-fips, buf, tkn, dagger, melange, aactl...

CVE-2023-39325 affecting package telegraf for versions less than 1.27.3-3

CVE-2023-39325 affecting package telegraf for versions less than 1.27.3-3. A patched version of the package is available...

CVE-2023-44487 affecting package telegraf for versions less than 1.27.3-3

CVE-2023-44487 affecting package telegraf for versions less than 1.27.3-3. A patched version of the package is available...

AZL-39704 CVE-2024-28180 affecting package telegraf for versions less than 1.31.0-1

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-38130 CVE-2024-28180 affecting package telegraf for versions less than 1.29.4-8

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

AZL-35751 CVE-2024-28110 affecting package telegraf for versions less than 1.31.0-1

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When...

CVE-2024-28110 vulnerabilities

Vulnerabilities for packages: falcosidekick, falcosidekick-fips, guac...

AZL-35761 CVE-2024-28110 affecting package telegraf for versions less than 1.28.5-5

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When...