Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 22

Export CSV
CVE-2019-3841

kubevirt/virt-cdi-importer: improper TLS certificate validation

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible undetected tampering of trusted container image content.

CVSS 3.0 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Kubevirt
Products
Containerized Data Importer
CVE-2019-10175

containerized-data-importer: Exposed read access to all storage currently allocated to PVCs regardless of namespace

A flaw was found in the containerized-data-importer in virt-cdi-cloner, version 1.4, where the host-assisted cloning feature does not determine whether the requesting user has permission to access the Persistent Volume Claim (PVC) in the source namespace. This could allow users to clone any PVC in the cluster into their own namespace, effectively allowing access to other user's data.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Kubevirt
Products
Containerized-data-importer