nmi

3 results · Clear filters · Feed

• Medium 5.3
  CVE-2022-23551

  AAD Pod Identity obtaining token with backslash

  aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in AAD Pod Identity intercepts and validates token requests based on regex. In this case, a token reques…

  Azure aad-pod-identity nmi github.com/Azure/aad-pod-identity Azure Linux Go
  Dec 21, 2022
• Medium 5.3
  CVE-2022-41717 Public exploit

  Excessive memory growth in net/http and golang.org/x/net/http2

  An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…

  Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 8, 2022
• Medium 5.3
  CVE-2022-29526

  golang.org/x/sys/unix has Incorrect privilege reporting in syscall

  Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Assignment. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.

  golang stdlib k3d golang-1.8 Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 22, 2022