TI-2023-10635 CVE-2023-25173 · GHSA-hmfx-3pcx-653p
containerd supplementary groups are not set up properly
Priority HIGH 67
containerd is an open source container runtime.
RHSA-2023:5314
OpenShift API for Data Protection (OADP) 1.1.6 security and bug fix update
Released 2023-09-20 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- 8Base-OADP-1.1 oadp/oadp-kubevirt-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8 +5
Fixes 5 records
TI-2022-06074 CVE-2022-21698 · GHSA-cg3q-j54f-5p7p
Uncontrolled Resource Consumption in promhttp
Priority MEDIUM 48
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.
TI-2022-20114 CVE-2022-41723 · GHSA-vvpx-j8f3-3w6h
Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
Priority MEDIUM 46
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
TI-2023-02112 CVE-2023-2253 · GHSA-hqxw-f8mx-cpmw
Resource allocation without limits in distribution/distribution
Priority LOW 31
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`).
TI-2023-10153 CVE-2023-24532 · GHSA-x2w5-7wp4-5qff
Incorrect calculation on P256 curves in crypto/internal/nistec
Priority LOW 26
The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars (a scalar larger than the order of the curve).