Security

A vulnerability in Helm allows attackers to exhaust all available memory and crash the application by using specially crafted chart archive files that expand dramatically when decompressed.

A vulnerability in Helm allows specially crafted JSON Schema files within charts to cause a stack overflow that can crash the application.

A vulnerability in Helm allows attackers to execute malicious code on the local system by using specially crafted Chart.yaml files and symbolic links to Chart.lock files when dependencies are updated.

A vulnerability in Helm allows malicious chart files to consume all available memory and crash the system through crafted JSON Schema references pointing to problematic files.

A vulnerability in Helm causes the application to crash when certain YAML configuration files contain invalid or empty values, affecting the tool's availability.

A vulnerability in Helm, a Kubernetes package manager, allows specially crafted charts to write files to the wrong directory during extraction, potentially overwriting existing files in the target location.

Helm, a package manager for Kubernetes, fails to properly verify plugin signatures in versions 4.0.0 to 4.1.3 and installs unsigned plugins despite enabled signature verification, allowing malicious plugins to execute arbitrary code.

A security vulnerability in Helm (Kubernetes package manager) allows malicious plugins to overwrite arbitrary files on the system, potentially compromising the entire system.

A vulnerability in containerd allows malicious containers with root privileges to start new processes with elevated privileges when running in the same network namespace as the shim.

A vulnerability in containerd version 1.2.x allows attackers to steal registry credentials by publishing malicious container images with special URLs that trick containerd into sending authentication data to attacker-controlled servers.

A bug in containerd's CRI implementation can cause containers using the same image to receive incorrect environment variables, potentially sharing sensitive information between containers with different security contexts.

A bug in containerd allows specially crafted container images to modify file permissions of existing files on the host system, potentially blocking access for legitimate users or widening access to others.

A permission flaw in containerd allowed regular Linux users to access container directories and execute programs with elevated privileges or read and modify files.

Containerd versions before 1.4.12 and 1.5.8 trust HTTP Content-Type headers when loading container images, allowing the same image digest to be interpreted differently and compromising the uniqueness of image identification.

A vulnerability in containerd allows containers on Linux systems with SELinux to relabel arbitrary host files through specially configured bind mounts, gaining full read/write access to those files.

A flaw in containerd allows containers with specially crafted configurations to access arbitrary files on the host system, potentially bypassing security policies and exposing sensitive information.

A bug in containerd caused containers to start with unusual Linux permissions, allowing programs inside containers to gain additional system privileges beyond what was intended.

A bug in containerd allows programs inside containers to consume unlimited memory when using the ExecSync function, potentially exhausting all available system memory and denying service to other legitimate workloads.

A bug in containerd's CRI implementation allows users to exhaust host memory by causing a goroutine memory leak when faulty commands are executed.

A bug in containerd causes supplementary user groups to be improperly set up in containers, potentially allowing attackers with direct container access to bypass group restrictions and gain access to sensitive information.

A vulnerability in containerd allows attackers to cause denial-of-service attacks through maliciously crafted container images with large files, as there was no size limit when importing certain files during image processing.

Containerd containers can access hardware power consumption data by default, allowing attackers to bypass security features like encryption by analyzing power usage patterns.

Containerd creates important directories with overly permissive access rights, allowing local users on the host to access container metadata and Kubernetes volumes, potentially leading to privilege escalation.

A bug in containerd causes containers with very large user IDs to run as root user due to a number overflow, bypassing security policies that require non-root execution.

A bug in containerd's CRI Attach function causes memory leaks through improperly terminated goroutines. Repeated kubectl attach commands can exhaust the host's memory, potentially slowing down or crashing the system.

A bug in containerd causes usernamespaced containers to bypass Kubernetes resource limits by not being placed under the proper control group hierarchy, potentially leading to denial of service of the Kubernetes node.

A vulnerability in containerd version 2.1.0 allows malicious container images to arbitrarily modify or create files on the host system during image download operations.

A bug in containerd causes containers with large numeric user IDs to incorrectly run as root, allowing security restrictions to be bypassed.

etcd, a distributed database, creates certain directories with restricted permissions but fails to verify that existing directories have these secure permissions, potentially allowing unintended data access.

A vulnerability in etcd allows an invalid index to be used when reading WAL entries, which can cause etcd nodes to crash during the consensus process.

A vulnerability in etcd allows attackers to create malicious WAL files with extremely large frame sizes that can crash the system when other cluster participants attempt to process them.

A vulnerability in etcd causes incomplete logging of authentication failures when users without passwords attempt to log in, making security monitoring more difficult.

A vulnerability in etcd allows negative values for data retention, causing the service to enter an infinite loop that consumes excessive CPU and floods logs.

A vulnerability in etcd causes the service to crash when a negative cluster size is provided during service discovery.

The etcd database supports insecure encryption methods for TLS connections, which could weaken communication security.

The etcd database does not validate user password length, allowing extremely short passwords like single characters, which makes it easier for attackers to guess or brute-force crack user credentials.

etcd stores user credentials like passwords unencrypted in WAL log files on disk, potentially exposing sensitive login information if these files are not properly secured.

A vulnerability in the etcd gateway allows configuring the gateway address as an endpoint, creating an infinite loop that exhausts all available file descriptors and crashes the service.

The etcd gateway component incompletely validates endpoints and allows connections to servers without TLS encryption through HTTPS URLs, potentially leading to insecure connections.

A vulnerability in etcd's gateway feature causes TLS authentication to only be performed for DNS SRV endpoints but not for manually specified endpoints, potentially allowing insecure connections.

A vulnerability in etcd's gateway component causes authentication settings of endpoints to not be properly validated, potentially allowing unauthorized access.

A vulnerability in etcd allows users to view key names through the LeaseTimeToLive API even without read permissions, leading to unintended information disclosure in authentication-enabled clusters.

A vulnerability in etcd allows unauthorized users to bypass authentication and authorization checks to call certain functions, enabling them to view cluster topology, disrupt services, or permanently delete data.

A vulnerability in etcd allows authenticated users to bypass access controls through nested transactions and access all stored data, even though they should only have restricted permissions.

A vulnerability in etcd allows authenticated users to bypass RBAC permission checks and gain unauthorized access to data or attach leases by using specific transaction operations.

A security vulnerability in Valkey allows authenticated users to cause a buffer overflow through specially crafted Lua scripts, potentially leading to remote code execution.

A vulnerability in Valkey allows authenticated users with sufficient privileges to create malformed ACL selectors that cause server crashes and denial of service when accessed.

A vulnerability in the Valkey database allows authenticated users to crash the service using specially crafted, extremely long text patterns, resulting in a denial-of-service attack.

A vulnerability in the Valkey database allows unauthenticated attackers to consume unlimited memory by causing output buffers to grow indefinitely, leading to server crashes or memory exhaustion.

A vulnerability in the Valkey database allows authenticated users to trigger memory corruption through specially crafted Lua scripts, potentially enabling remote code execution on the server.