A flaw was found in the key export functionality of libssh

A denial of service (DoS) vulnerability was found in OpenShift

A vulnerability was found in Podman, Buildah, and CRI-O

Keycloak: potential bypass of brute force protection

A flaw was found in the Openshift console

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP)

A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`)

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service

An Improper Certificate Validation attack was found in Openshift

A flaw was found in dpdk

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products

A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1,…

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher

The kubectl cp command allows copying files between containers and the user machine

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch…

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts,…

A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request…

Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the…

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function…

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed

Libssh: improper sanitation of paths received from scp servers

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy…

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels

A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass…

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF…

Sssd: sssd: denial of service via incomplete identity provider authentication requests

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Sssd: sssd: information disclosure via odata injection in entra id lookups

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

A misconfiguration flaw was found in Keycloak

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers

The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging…

A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3

A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1

Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or…

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle…

Dnsmasq: dnsmasq: heap buffer overflow in log_query() when logging unsupported ds/dnskey replies

Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some…

A vulnerability was found in OpenShift OSIN

A flaw was found in openshift-ansible

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not…

It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds