CVSS: 9.1EPSS: 0%CPEs: 6EXPL: 0CVE-2022-0670 – ceph: user/tenant can obtain access (read/write) to any share
https://notcve.org/view.php?id=CVE-2022-0670
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2. Se ha encontrado un fallo en Openstack manilla que posee un "share" del sistema de archivos Ceph, que permite al propietario leer/escribir cualquier manilla compartido o todo el sistema de archivos. • https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5O3XMDFZWA2FWU6GAYOVSFJPOUTXN42N https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TIRTTRG5O4YP2TNGDCDOHIHP2DM3DFBT https://access.redhat.com/security/cve/CVE-2022-0670 https://bugzilla.redhat.com/show_bug.cgi?id=2050728 • CWE-863: Incorrect Authorization •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34632
https://notcve.org/view.php?id=CVE-2022-34632
Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala. Se ha detectado que el commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 de Rocket-Chip contiene criptografía insuficiente por medio del componente /rocket/RocketCore.scala. • https://github.com/chipsalliance/rocket-chip/pull/2950#issuecomment-1106745660 https://github.com/chipsalliance/rocket-chip/pull/2950#issuecomment-1107055607 https://github.com/chipsalliance/rocket-chip/pull/2950/commits/4f8114374d8824dfdec03f576a8cd68bebce4e56 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31102 – Cross-site Scripting for Argo CD single sign on users
https://notcve.org/view.php?id=CVE-2022-31102
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting (XSS) bug which could allow an attacker to inject arbitrary JavaScript in the `/auth/callback` page in a victim's browser. This vulnerability only affects Argo CD instances which have single sign on (SSO) enabled. The exploit also assumes the attacker has 1) access to the API server's encryption key, 2) a method to add a cookie to the victim's browser, and 3) the ability to convince the victim to visit a malicious `/auth/callback` link. The vulnerability is classified as low severity because access to the API server's encryption key already grants a high level of access. • https://github.com/argoproj/argo-cd/releases/tag/v2.3.6 https://github.com/argoproj/argo-cd/releases/tag/v2.4.5 https://github.com/argoproj/argo-cd/security/advisories/GHSA-pmjg-52h9-72qv • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.6EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31105 – Argo CD's certificate verification is skipped for connections to OIDC providers
https://notcve.org/view.php?id=CVE-2022-31105
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or otherwise untrustworthy) OpenID Connect (OIDC) provider. A patch for this vulnerability has been released in Argo CD versions 2.4.5, 2.3.6, and 2.2.11. There are no complete workarounds, but a partial workaround is available. Those who use an external OIDC provider (not the bundled Dex instance), can mitigate the issue by setting the `oidc.config.rootCA` field in the `argocd-cm` ConfigMap. • https://github.com/argoproj/argo-cd/releases/tag/v2.3.6 https://github.com/argoproj/argo-cd/releases/tag/v2.4.5 https://github.com/argoproj/argo-cd/security/advisories/GHSA-7943-82jg-wmw5 • CWE-295: Improper Certificate Validation CWE-599: Missing Validation of OpenSSL Certificate •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2022-31080 – KubeEdge Websocket Client in package Viaduct: DoS from large response message
https://notcve.org/view.php?id=CVE-2022-31080
KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, a large response received by the viaduct WSClient can cause a DoS from memory exhaustion. The entire body of the response is being read into memory which could allow an attacker to send a request that returns a response with a large body. The consequence of the exhaustion is that the process which invokes a WSClient will be in a denial of service. The software is affected If users who are authenticated to the edge side connect to `cloudhub` from the edge side through WebSocket protocol. • https://github.com/kubeedge/kubeedge/security/advisories/GHSA-6wvc-6pww-qr4r • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •