Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2024-3727

Containers/image: digest type does not guarantee valid type

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

CVSS 3.1 · 8.3 High EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Acm Advanced Cluster Security Ansible Automation Platform and 16 more
CVE-2023-44487

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Akka Amazon Apache and 30 more
Products
Http Server Opensearch Data Prepper Apisix and 375 more
CVE-2023-25173

containerd supplementary groups are not set up properly

containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases, potentially gaining access to sensitive information or gaining the ability to execute code in that container. Downstream applications that use the containerd client library may be affected as well. This bug has been fixed in containerd v1.6.18 and v.1.5.18. Users should update to these versions and recreate containers to resolve this issue. Users who rely on a downstream application that uses containerd's client library should check that application for a separate advisory and instructions. As a workaround, ensure that the `"USER $USERNAME"` Dockerfile instruction is not used. Instead, set the container entrypoint to a value similar to `ENTRYPOINT ["su", "-", "user"]` to allow `su` to properly set up supplementary groups.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Linuxfoundation Redhat
Products
Containerd Container Native Virtualization Enterprise Linux and 6 more
CVE-2023-3089

Ocp & fips mode

A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Amq Streams Container Native Virtualization and 15 more
CVE-2022-30632

Stack exhaustion on crafted paths in path/filepath

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Golang Redhat
Products
Go Acm Application Interconnect and 15 more
CVE-2022-2832

blender: Null pointer reference in blender thumbnail extractor

A flaw was found in Blender 3.3.0. A null pointer dereference exists in source/blender/gpu/opengl/gl_backend.cc that may lead to loss of confidentiality and integrity.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Blender Redhat
Products
Blender Openshift Sandboxed Containers
CVE-2021-44716

golang: net/http: limit growth of header canonicalization cache

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.

CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed
Vendors
Debian Golang Netapp and 1 more
Products
Debian Linux Go Cloud Insights Telegraf and 13 more
CVE-2021-36221

golang: net/http/httputil: panic due to racy read of persistConn after handler panic

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

CVSS 3.1 · 5.9 Medium EPSS 3.1% KEV · Not listed
Vendors
Debian Fedoraproject Golang and 3 more
Products
Debian Linux Fedora Go and 12 more
CVE-2021-34558

golang: crypto/tls: certificate of wrong type is causing TLS client to panic

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

CVSS 3.1 · 6.5 Medium EPSS 7.0% KEV · Not listed
Vendors
Fedoraproject Golang Netapp and 2 more
Products
Fedora Go Cloud Insights Telegraf and 16 more