CVE-2023-42815 Denial of service from malicious image manifest in kyverno

Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch...

CVE-2023-42815 Denial of service from malicious image manifest in kyverno

Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch...

CVE-2023-42816 Denial of service from malicious signature in kyverno

Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch...

CVE-2023-42816

CVE-2023-42816 describes a denial-of-service vulnerability in Kyverno’s Notary verifier component. If an attacker gains control of the registry Kyverno fetches signatures from, they can return a malicious response during signature verification, causing Kyverno to crash and block subsequent admiss...

CVE-2023-42816 Denial of service from malicious signature in kyverno

Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch...

PT-2023-28603 · Kyverno · Kyverno

Name of the Vulnerable Software and Affected Versions: Kyverno versions 1.11.0 and later, built from the main branch Description: A security issue was found in Kyverno, a policy engine for Kubernetes, where an attacker could cause a denial of service. The issue lies in Kyverno's Notary verifier. ...

PT-2023-28602 · Kyverno · Kyverno

Name of the Vulnerable Software and Affected Versions: Kyverno version 1.11.0 Description: A security issue was found in Kyverno, a policy engine for Kubernetes, where an attacker could cause denial of service. The issue is in Kyverno's Notary verifier. An attacker would need control over the...

PT-2023-28601 · Kyverno · Kyverno

Name of the Vulnerable Software and Affected Versions: Kyverno versions 1.11.0 and later, built from the main branch Description: A security issue was found in Kyverno, a policy engine for Kubernetes, where an attacker could cause denial of service. The vulnerable component is Kyverno's Notary...

PT-2023-28600 · Kyverno · Kyverno

Name of the Vulnerable Software and Affected Versions: Kyverno versions 1.11.0 and later built from the main branch Description: A security issue was found in Kyverno, a policy engine for Kubernetes, where an attacker could cause denial of service. The vulnerable component is Kyverno's Notary...

GHSA-R2XV-VPR2-42M9 slsa-verifier vulnerable to mproper validation of npm's publish attestations

Summary slsa-verifier attestationstampered.json 5. SLSAVERIFIEREXPERIMENTAL=1 slsa-verifier verify-npm-package supreme-goggles.tgz --attestations-path attestationstampered.json --builder-id "https://github.com/actions/runner/github-hosted" --package-name "@trishankatdatadog/supreme-goggles"...

kernel: bpf, verifier: Fix memory leak in array reallocation for stack state

A flaw was found in the eBPF subsystem in the Linux kernel. An incorrect logic in a helper function for memory reallocation can cause memory leaks when a memory allocation error occurs, potentially leading to system instability and a denial of service...

kernel: bpf: Skip invalid kfunc call in backtrack_insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip invalid kfunc call in backtrackinsn The verifier skips invalid kfunc call in checkkfunccall, which would be captured in fixupkfunccall if such insn is not eliminated by dead code elimination. However, this can lead to t...

kernel: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation

A vulnerability was found in the Linux kernel's eBPF verifier function checkstackwrite, where pointer leakage can occur due to insufficient speculative store bypass mitigation. This issue occurs because the original mitigation inserts lfence instructions after initializing a stack slot and spilli...

kernel: bpf: Fix reference state management for synchronous callbacks

A flaw was found in the Linux kernel's BPF verifier. The verifier incorrectly handles reference state management for synchronous callbacks that execute multiple times foreach style helpers. This can lead to reference leaks when callbacks acquire references, or double-free conditions when callback...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: ctop, bom, falcoctl-fips, k3d, k3s, rancher-agent, tekton-chains, skaffold, up, spire-server-fips, slsa-verifier, kubescape, kpt, aactl, paranoia, scorecard, chartmuseum...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: buildkitd, up, kubeflow, k3d, src, kubescape, spark-operator, aactl, prometheus-blackbox-exporter, terraform-provider-sendgrid, scorecard, slsa-verifier, dgraph, kubevela, cortex...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: falcoctl-fips, kube-oidc-proxy, prometheus-adapter-fips, prometheus-stackdriver-exporter, bank-vaults-fips, kubescape, terraform-provider-sendgrid, volume-modifier-for-k8s-fips, k3d, vault-csi-provider, prometheus-blackbox-exporter, terraform-provider-sendgrid-fips,...

GO-2023-2119 Proof forgery due to insufficient randomness in github.com/consensys/gnark

A a third party may derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. This vulnerability is due to randomness being generated using a small part of the scratch memory describing the state, allowing for degrees of...

Plonk verifier KZG multi point verification

Impact The vulnerability allows a third party to derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. It is due to a randomness being generated using a small part of the scratch memory describing the state, allowing for...

GHSA-7P92-X423-VWJ6 Plonk verifier KZG multi point verification

Impact The vulnerability allows a third party to derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. It is due to a randomness being generated using a small part of the scratch memory describing the state, allowing for...