Samba: group policy certificate enrollment uses http:// without validation

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

A flaw was found in rsync

A flaw was found in the offline_access scope in Keycloak

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed

A flaw was found in polkit

A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication

A vulnerability has been identified in the libarchive library

A vulnerability has been identified in the libarchive library

A flaw was found in OpenShift Container Platform where OAuth tokens are not encrypted when the encryption of data at rest is enabled

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Openshift/router: openshift/router: cloud metadata ssrf via fqdn-typed endpointslice bypasses destination validation

Samba: missing access check on reparse point operations

Samba: vfs_worm does not block directory modification

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

Libarchive: libarchive: denial of service via malformed iso file processing

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

A flaw was found in the key export functionality of libssh

A denial of service (DoS) vulnerability was found in OpenShift

A vulnerability was found in Podman, Buildah, and CRI-O

Keycloak: potential bypass of brute force protection

A flaw was found in the Openshift console

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP)

A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`)

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service

An Improper Certificate Validation attack was found in Openshift

A flaw was found in dpdk

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products

A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1,…

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher

The kubectl cp command allows copying files between containers and the user machine

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch…

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier in blueocean-core-js/src/js/bundleStartup.js, blueocean-core-js/src/js/fetch.ts,…

A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request…

Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the…

GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function…

GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed

Libssh: improper sanitation of paths received from scp servers

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy…

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels

A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass…