Skip to content
OpenAdvisories
Medium WID-SEC-2024-1707 3 CVEs

Red Hat Advanced Cluster Security for Kubernetes: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Jul 24, 2024 · Updated Jul 24, 2024 · de-DE

Vendor: Red Hat Product: Enterprise Linux Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Advanced Cluster Security for Kubernetes ausnutzen, um Informationen offenzulegen.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 3

  • Medium 6.5
    CVE-2024-28849

    Proxy-Authorization header kept across hosts in follow-redirects

    follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authent…

    follow-redirects follow-redirects lerna kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  • Medium 4.2
    CVE-2024-29902

    Cosign vulnerable to system-wide denial of service via malicious attachments

    Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, a remote image with a malicious attachment can cause denial of service of the host machine running Cosign. This can impact other services on the machine that re…

    sigstore cosign zot kubescape Wolfi Go
  • Medium 4.2
    CVE-2024-29903

    Cosign vulnerable to machine-wide denial of service via malicious artifacts

    Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause i…

    sigstore cosign zot kubescape Wolfi Go

Revision history

  1. #1

    Initiale Fassung

References