GHSA-V8MX-HP2Q-GW85 Golang SDK for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

Server/API for Vela Insecure Variable Substitution

Impact Vela pipelines can use variable substitution combined with insensitive fields like parameters, image and entrypoint to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block...

Unauthorized File Access

org.apache.pulsar: pulsar-functions-worker is vulnerable to Unauthorized File Access. The vulnerability is due to a feature that allows authenticated users to create functions with implementations referenced by URLs, including file, http, and https schemes. This vulnerability can potentially lead...

Unspecified Vulnerability in Apache Pulsar (CNVD-2024-26183)

Apache Pulsar is the United States Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as one of the distributed message flow platform. The software supports multi-tenant, persistent storage, multi-machine room cross-region data replication,...

PT-2024-21538

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data-race issue was identified in the Linux kernel when accessing keypair-receiving counter.counter. The issue was detected by Syzkaller with KCSAN and is related to the wg packet...

SUSE CVE-2023-52491

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtkjpegdecdevicerun In mtkjpegprobe, &jpeg-jobtimeoutwork is bound with mtkjpegjobtimeoutwork. In mtkjpegdecdevicerun, if error happens in mtkjpegsetdecdst, it...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5, <=2.7.1.6), com.clever-cloud:biscuit-pulsar (>=2.2.2, <=3.2.1) +11 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=2.4.0, <=2.10.5)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.4.0, =2.7.1.5, =2.2.2, =3.1.7, =3.6, =3.6, =0.0.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.0.0, =1.1.0 Source cves: CVE-2024-27894 Source advisory: OSV:GHSA-C2X9-VW5H-39VC...

org.apache.pulsar:pulsar-broker (3.2.0), org.apache.pulsar:pulsar-broker-auth-athenz (3.2.0) +3 more potentially affected by CVE-2024-27135 via org.apache.pulsar:pulsar-functions-worker (3.2.0)

org.apache.pulsar:pulsar-functions-worker MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-functions-worker and may be impacted: - org.apache.pulsar:pulsar-broker 3.2.0 -...

io.github.embedded-middleware:embedded-pulsar-core (>=0.0.4, <=0.0.5), org.apache.pulsar:pulsar-broker (>=2.11.0, <=2.11.3) +4 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (>=2.11.0, <=2.11.3)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.11.0, =0.0.4, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.3 Source cves: CVE-2024-27317 Source advisory: GHSA-JG2G-4RJG-CMQH...

io.github.embedded-middleware:embedded-pulsar-core (>=0.0.4, <=0.0.5), org.apache.pulsar:pulsar-broker (>=2.11.0, <=2.11.3) +4 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (>=2.11.0, <=2.11.3)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.11.0, =0.0.4, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.3 Source cves: CVE-2024-27317 Source advisory: OSV:GHSA-JG2G-4RJG-CMQH...

GHSA-C2X9-VW5H-39VC Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...

org.apache.pulsar:pulsar-broker (>=3.1.0, <=3.1.2), org.apache.pulsar:pulsar-broker-auth-athenz (>=3.1.0, <=3.1.2) +3 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=3.1.0, <=3.1.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.2 Source cves: CVE-2024-27894 Source advisory: OSV:GHSA-C2X9-VW5H-39VC...

org.apache.pulsar:pulsar-broker (3.2.0), org.apache.pulsar:pulsar-broker-auth-athenz (3.2.0) +3 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (3.2.0)

org.apache.pulsar:pulsar-functions-worker MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-functions-worker and may be impacted: - org.apache.pulsar:pulsar-broker 3.2.0 -...

org.apache.pulsar:pulsar-broker (>=3.1.0, <=3.1.2), org.apache.pulsar:pulsar-broker-auth-athenz (>=3.1.0, <=3.1.2) +3 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=3.1.0, <=3.1.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.2 Source cves: CVE-2024-27894 Source advisory: GHSA-C2X9-VW5H-39VC...

Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...

io.github.embedded-middleware:embedded-pulsar-core (>=0.0.4, <=0.0.5), org.apache.pulsar:pulsar-broker (>=2.11.0, <=2.11.3) +4 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=2.11.0, <=2.11.3)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.11.0, =0.0.4, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.0, =2.11.3 Source cves: CVE-2024-27894 Source advisory: GHSA-C2X9-VW5H-39VC...

org.apache.pulsar:pulsar-broker (3.2.0), org.apache.pulsar:pulsar-broker-auth-athenz (3.2.0) +3 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (3.2.0)

org.apache.pulsar:pulsar-functions-worker MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-functions-worker and may be impacted: - org.apache.pulsar:pulsar-broker 3.2.0 -...

org.apache.pulsar:pulsar-broker (>=3.1.0, <=3.1.2), org.apache.pulsar:pulsar-broker-auth-athenz (>=3.1.0, <=3.1.2) +3 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (>=3.1.0, <=3.1.2)

org.apache.pulsar:pulsar-functions-worker MAVEN version =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.2 Source cves: CVE-2024-27317 Source advisory: GHSA-JG2G-4RJG-CMQH...

org.apache.pulsar:pulsar-broker (3.2.0), org.apache.pulsar:pulsar-broker-auth-athenz (3.2.0) +3 more potentially affected by CVE-2024-27317 via org.apache.pulsar:pulsar-functions-worker (3.2.0)

org.apache.pulsar:pulsar-functions-worker MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.pulsar:pulsar-functions-worker and may be impacted: - org.apache.pulsar:pulsar-broker 3.2.0 -...

co.macrometa.c8streams.handlers:kop (>=2.7.1.5, <=2.7.1.6), com.clever-cloud:biscuit-pulsar (>=2.2.2, <=3.2.1) +11 more potentially affected by CVE-2024-27894 via org.apache.pulsar:pulsar-functions-worker (>=2.4.0, <=2.10.5)

org.apache.pulsar:pulsar-functions-worker MAVEN version =2.4.0, =2.7.1.5, =2.2.2, =3.1.7, =3.6, =3.6, =0.0.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =1.0.0, =1.1.0 Source cves: CVE-2024-27894 Source advisory: GHSA-C2X9-VW5H-39VC...