Base de CVEs

Os componentes internos de autenticação das versões do Idira Secrets Manager SaaS Edge anteriores à 1.8 apresentam controle de acesso inadequado. Um atacante remoto e não autenticado poderia explorar isso enviando uma requisição especialmente elaborada. Em circunstâncias específicas, isso poderia permitir que o atacante manipule mecanismos internos de validação, potencialmente levando a um bypass da verificação de identidade e à obtenção não autorizada de um token de acesso. CyberArk Security Bulletin: CA26-20

Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to run untrusted code. Prior to version 0.9.0, Boxlite does not restrict the kernel capabilities available inside the container, malicious code can remount the directory in rw mode, thereby gaining write access to that directory. This allows malicious code to perform arbitrary write operations on directories that should be read-only. This issue has been patched in version 0.9.0.

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, the Fission router registers an internal-style route — /fission-function/<name> and /fission-function/<ns>/<name> — for every Function object, independent of whether any HTTPTrigger exists for that function. The route was mounted on the same listener as user-defined HTTPTriggers (svc/router, port 8888), so any caller who could reach the router could invoke any function by guessing its metadata.name (and namespace), bypassing the host / path / method / method-allow-list restrictions encoded in HTTPTrigger objects. This issue has been patched in version 1.23.0.