Trident

CVEs (11)

• CVE-2018-1002105CriDec 5, 2018
  Cri O

  Kubernetes
  risk 0.67cvss 9.8epss 0.87

  In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then…

• CVE-2020-29511CriDec 14, 2020
  Go

  encoding/xml
  risk 0.64cvss 9.8epss 0.02

  The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected…

• CVE-2020-29510CriDec 14, 2020
  Go

  encoding/xml
  risk 0.64cvss 9.8epss 0.02

  The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream…

• CVE-2020-29509CriDec 14, 2020
  Golang

  Go
  risk 0.57cvss 9.8epss 0.02

  The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected…

• CVE-2019-11243HigApr 22, 2019
  Cri O

  Kubernetes
  risk 0.53cvss 8.1epss 0.01

  In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not…

• CVE-2021-25742HigOct 29, 2021
  Cri O

  Ingress Nginx
  risk 0.50cvss 7.6epss 0.02

  A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

• CVE-2020-28362HigNov 18, 2020
  Golang

  Go
  risk 0.49cvss 7.5epss 0.04

  Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.

• CVE-2019-9514HigAug 13, 2019
  Fedoraproject

  Fedora
  risk 0.48cvss 7.5epss 0.83

  Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the…

• CVE-2021-34558MedJul 15, 2021
  Go

  crypto/tls
  risk 0.43cvss 6.5epss 0.07

  The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

• CVE-2020-28366HigNov 18, 2020
  Go

  go command
  risk 0.42cvss 7.5epss 0.02

  Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.

• CVE-2019-11244MedApr 22, 2019
  Cri O

  Kubernetes
  risk 0.26cvss 5.0epss 0.00

  In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to…