Open Source Vulnerabilities

kubernetes

Security fix for GHSA-rm3j-f69w-wqmq applied in: kubernetes 1.34.10-r2

kubernetes

OpenTelemetry-Go is the Go implementation of OpenTelemetry

kubernetes

Security fix for GHSA-5cgq-3rg8-m6cv applied in: kubernetes 1.34.10-r2

ollama, ollama

zlib before 1

kubernetes

gRPC-Go is the Go language implementation of gRPC

kubernetes

malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

kubernetes

malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

prometheus

ReverseProxy can forward queries containing parameters not visible to Rewrite functions

prometheus

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

kubernetes

OpenTelemetry-Go is the Go implementation of OpenTelemetry

prometheus

Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

openssl-3-livepatches

Security update for openssl-3-livepatches

grafana-alloy, kubernetes, kubernetes, kubernetes

Moby is an open source container framework

prometheus

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations

kubernetes, ollama, ollama, prometheus

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0

grafana-alloy, kubernetes, kubernetes, kubernetes

Moby is an open source container framework

prometheus

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash

kubernetes, ollama, ollama, prometheus, trust-manager

ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label

haproxy

Security update for haproxy

kubernetes, ollama, ollama

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

kubernetes

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not

ollama, ollama

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image

kubernetes

Previously, resolving relative paths containing parent directory ('

kubernetes, ollama, ollama, prometheus

Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation

linux, linux-aws, linux-azure, linux-lts-xenial, linux, linux-aws, linux-aws-hwe, linux-azure, linux-gcp, linux-hwe, linux-hwe-edge, linux-kvm, linux-oracle, linux-fips, linux-fips, linux, linux-aws, linux-aws-5.0, linux-aws-5.3, linux-aws-5.4, linux-azure, linux-azure-4.15, linux-azure-5.3, linux-azure-5.4, linux-azure-edge, linux-gcp, linux-gcp-4.15, linux-gcp-5.3, linux-gcp-5.4, linux-gke-4.15, linux-gke-5.4, linux-gkeop-5.4, linux-hwe, linux-hwe-5.4, linux-hwe-edge, linux-ibm-5.4, linux-kvm, linux-oem, linux-oracle, linux-oracle-5.0, linux-oracle-5.3, linux-oracle-5.4, linux-raspi-5.4, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux, linux-aws, linux-aws-5.11, linux-aws-5.13, linux-aws-5.15, linux-aws-5.8, linux-azure, linux-azure-5.11, linux-azure-5.13, linux-azure-5.15, linux-azure-5.8, linux-azure-fde, linux-azure-fde-5.15, linux-bluefield, linux-gcp, linux-gcp-5.11, linux-gcp-5.13, linux-gcp-5.15, linux-gcp-5.8, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.11, linux-hwe-5.13, linux-hwe-5.15, linux-hwe-5.8, linux-ibm, linux-ibm-5.15, linux-intel-5.13, linux-intel-iotg-5.15, linux-iot, linux-kvm, linux-lowlatency-hwe-5.15, linux-nvidia-tegra-5.15, linux-oem-5.10, linux-oem-5.13, linux-oem-5.14, linux-oem-5.6, linux-oracle, linux-oracle-5.11, linux-oracle-5.13, linux-oracle-5.15, linux-oracle-5.8, linux-raspi, linux-raspi2, linux-riscv, linux-riscv-5.11, linux-riscv-5.15, linux-riscv-5.8, linux-xilinx-zynqmp, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux, linux-allwinner-5.19, linux-aws, linux-aws-5.19, linux-aws-6.2, linux-aws-6.5, linux-aws-6.8, linux-azure, linux-azure-5.19, linux-azure-6.2, linux-azure-6.5, linux-azure-6.8, linux-azure-fde, linux-azure-fde-5.19, linux-azure-fde-6.2, linux-azure-fde-6.8, linux-gcp, linux-gcp-5.19, linux-gcp-6.2, linux-gcp-6.5, linux-gcp-6.8, linux-gke, linux-gkeop, linux-hwe-5.19, linux-hwe-6.2, linux-hwe-6.5, linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-intel-iot-realtime, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.19, linux-lowlatency-hwe-6.2, linux-lowlatency-hwe-6.5, linux-lowlatency-hwe-6.8, linux-nvidia, linux-nvidia-6.2, linux-nvidia-6.5, linux-nvidia-6.8, linux-nvidia-tegra, linux-nvidia-tegra-igx, linux-oem-5.17, linux-oem-6.0, linux-oem-6.1, linux-oem-6.5, linux-oracle, linux-oracle-6.5, linux-oracle-6.8, linux-raspi, linux-realtime, linux-riscv, linux-riscv-5.19, linux-riscv-6.5, linux-riscv-6.8, linux-starfive-5.19, linux-starfive-6.2, linux-starfive-6.5, linux-xilinx-zynqmp, linux-bluefield, linux-intel-iot-realtime, linux-realtime, linux-realtime-6.8, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux, linux-aws, linux-aws-6.14, linux-aws-6.17, linux-aws-7.0, linux-azure, linux-azure-6.11, linux-azure-6.14, linux-azure-6.17, linux-azure-7.0, linux-azure-fde, linux-azure-fde-6.14, linux-azure-fde-6.17, linux-azure-fde-7.0, linux-azure-nvidia, linux-azure-nvidia-6.14, linux-gcp, linux-gcp-6.11, linux-gcp-6.14, linux-gcp-6.17, linux-gcp-7.0, linux-gke, linux-gkeop, linux-hwe-6.11, linux-hwe-6.14, linux-hwe-6.17, linux-hwe-7.0, linux-ibm, linux-lowlatency, linux-lowlatency-hwe-6.11, linux-nvidia, linux-nvidia-6.11, linux-nvidia-6.17, linux-nvidia-7.0, linux-nvidia-lowlatency, linux-nvidia-tegra, linux-oem-6.11, linux-oem-6.14, linux-oem-6.17, linux-oem-6.8, linux-oracle, linux-oracle-6.14, linux-oracle-6.17, linux-oracle-7.0, linux-raspi, linux-raspi-realtime, linux-realtime, linux-riscv, linux-riscv-6.14, linux-riscv-6.17, linux-riscv-7.0, linux-vmware, linux-xilinx, linux-bluefield, linux-raspi-realtime, linux-realtime, linux-realtime-6.14, linux-realtime-6.17, linux-aws-fips, linux-azure-fips, linux-fips, linux-gcp-fips, linux, linux-aws, linux-azure, linux-azure-fde, linux-gcp, linux-oracle, linux-raspi, linux-realtime, linux-riscv, linux, linux-aws, linux-azure, linux-azure-fde, linux-gcp, linux-gke, linux-ibm, linux-nvidia, linux-nvidia-bos, linux-oem-7.0, linux-oracle, linux-raspi, linux-realtime, linux-riscv

ollama, ollama

TIFF decoder does not place a limit on the size of PackBits-compressed data

kubernetes

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

ollama, ollama

Parsing a WEBP image with an invalid, large size panics on 32-bit platforms

kubernetes

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS

ollama, ollama, prometheus

in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

ollama, ollama

Parsing a malicious font file can cause excessive memory allocation

kubernetes

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Gcc: stack overflow in std::bitset on libstdc++

kubernetes

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

kubernetes, ollama, ollama, prometheus

malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop

kubernetes

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption

kubernetes, ollama, ollama, prometheus

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

kubernetes, ollama, ollama, prometheus

For certain crafted inputs, a 'ed25519

kubernetes, ollama, ollama, prometheus

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

kubernetes, ollama, ollama, prometheus

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty pa...

kubernetes, ollama, ollama, prometheus

NewNTUnicodeString does not check for string length overflow

ollama, ollama, prometheus

authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

kubernetes, ollama, ollama, prometheus

incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

kubernetes, ollama, ollama, prometheus

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree

kubernetes, ollama, ollama, prometheus

Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation wou...

kubernetes, ollama, ollama, prometheus

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service

kubernetes, ollama, ollama, prometheus

SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

prometheus

(*x509

kubernetes, ollama, ollama, prometheus

When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh

kubernetes, ollama, ollama, prometheus

Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh