cri-tools vulnerabilities (Red Hat)
152 vulnerabilities.
cri-toolsRed HatThe crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key...6.5 Mediumcri-toolsRed HatGo before 1.15.12 and 1.16.x before 1.16.5 attempts to allocate excessive memory (issue 2 of 2).7.5 Highcri-toolsRed HatGo before 1.15.12 and 1.16.x before 1.16.5 acts as an Unintended Proxy or Intermediary.5.3 Mediumcri-toolsRed HatGo before 1.15.12 and 1.16.x before 1.16.5 allows injection.7.3 Highcri-toolsRed HatValidating Admission Webhook does not observe some previous fields6.5 Mediumcri-toolsRed Hatgolang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion5.9 Mediumcri-toolsRed Hatmount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs8.5 Highcri-toolsRed HatCross-Site Request Forgery in Jenkins Credentials Plugin6.1 Mediumcri-toolsRed HatImproper Handling of Highly Compressed Data (Data Amplification) and Memory Allocation with Excessive Size Value in eventlet5.3 Mediumcri-toolsRed HatMissing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs4.3 Mediumcri-toolsRed HatCSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files5.4 Mediumcri-toolsRed HatIncorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs6.5 Mediumcri-toolsRed HatXML External Entity Reference vulnerability in Jenkins Config File Provider Plugin8.1 Highcri-toolsRed HatDenial of service in gopkg.in/yaml.v25.5 Mediumcri-toolsRed HatView name validation bypass in Jenkins4.3 Mediumcri-toolsRed HatLack of type validation in agent related REST API in Jenkins4.3 Mediumcri-toolsRed HatImproper Locking in github.com/containers/storage6.5 Mediumcri-toolsRed HatJetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources7.5 Highcri-toolsRed HatDirectory exposure in jetty2.7 Lowcri-toolsRed HatIncorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items6.5 Mediumcri-toolsRed HatIn Go before 1.14.14 and 1.15.x before 1.15.7, crypto/elliptic/p224.go can generate incorrect...6.5 Mediumcri-toolsRed HatStored XSS vulnerability in Jenkins on new item page5.4 Mediumcri-toolsRed HatReflected XSS vulnerability in Jenkins markup formatter preview6.1 Mediumcri-toolsRed HatMissing permission check for paths with specific prefix in Jenkins5.3 Mediumcri-toolsRed HatStored XSS vulnerability in Jenkins button labels5.4 Mediumcri-toolsRed HatExcessive memory allocation in graph URLs leads to denial of service in Jenkins6.5 Mediumcri-toolsRed HatArbitrary file existence check in file fingerprints in Jenkins4.3 Mediumcri-toolsRed HatPath traversal vulnerability in Jenkins agent names8.0 Highcri-toolsRed HatImproper handling of REST API XML deserialization errors in Jenkins8.0 Highcri-toolsRed HatXSS vulnerability in Jenkins notification bar5.4 Mediumcri-toolsRed HatArbitrary file read vulnerability in workspace browsers in Jenkins6.5 Mediumcri-toolsRed HatImproper Input Validation in GoGo Protobuf8.6 Highcri-toolsRed HatCeph RBD adminSecrets exposed in logs when loglevel >= 44.7 Mediumcri-toolsRed HatGo before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.7.5 Highcri-toolsRed HatTiming attacks in python-rsa7.5 Highcri-toolsRed Hatcontainerd can be coerced into leaking credentials during image pull6.1 Mediumcri-toolsRed HatWithdrawn Advisory: Infinite loop in xz7.5 Highcri-toolsRed HatGo before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as...5.9 Mediumcri-toolsRed HatIn libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a...5.6 Mediumcri-toolsRed HatImproper Neutralization of Special Elements used in an OS Command in Jenkins Git Client Plugin8.8 Highcri-toolsRed HatKubernetes kube-apiserver allows access to custom resources via wrong scope5.0 Mediumcri-toolsRed HatSome HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service7.5 Highcri-toolsRed HatSome HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service7.5 Highcri-toolsRed HatA vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able...3.6 Lowcri-toolsRed HatThe OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker...5.0 Mediumcri-toolsRed HatThe OpenShift image import whitelist failed to enforce restrictions correctly when running...4.3 Mediumcri-toolsRed HatKubernetes arbitrary file overwrite4.2 Mediumcri-toolsRed HatKubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error (CWE-270)...8.8 Highcri-toolsRed HatExposure of Sensitive Information to an Unauthorized Actor in Jenkins5.3 Medium