What's new arround internet
Last one

Src Date (GMT) Titre Description Tags Stories Notes
Google.webp 2024-07-18 17:31:38 GCP-2024-018 (lien direct) Published: 2024-03-12Updated: 2024-04-04, 2024-05-06Description Description Severity Notes 2024-05-06 Update: Added patch versions for GKE Ubuntu node pools. 2024-04-04 Update: Corrected minimum versions for GKE Container-Optimized OS node pools. The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-1085 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-1085
Google.webp 2024-07-18 17:31:38 GCP-2024-026 (lien direct) Published: 2024-05-07Updated: 2024-05-09Description Description Severity Notes 2024-05-09 Update: Corrected severity from Medium to High. The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26643 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-26643
Google.webp 2024-07-18 17:31:38 GCP-2024-045 (lien direct) Published: 2024-07-17Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26925 For instructions and more details, see the following bulletins: GKE security bulletin GDC software for VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GDC software for bare metal security bulletin High CVE-2024-26925
Google.webp 2024-07-18 17:31:38 GCP-2024-034 (lien direct) Published: 2024-06-11Updated: 2024-07-10Description Description Severity Notes 2024-07-10 Update: Added patch versions for Container-Optimized OS nodes running minor version 1.26 and 1.27 and added patch versions for Ubuntu nodes. The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:CVE-2024-26583 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-26583
Google.webp 2024-07-18 17:31:38 GCP-2024-039 (lien direct) Published: 2024-06-28Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26923 For instructions and more details, see the following bulletins: GKE security bulletin GDC software for VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GDC software for bare metal security bulletin High CVE-2024-26923
Google.webp 2024-07-18 17:31:38 GCP-2024-014 (lien direct) Published: 2024-02-26Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2023-3776 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2023-3776
Google.webp 2024-07-18 17:31:38 GCP-2024-038 (lien direct) Published: 2024-06-26Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26924 For instructions and more details, see the following bulletins: GKE security bulletin GDC software for VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GDC software for bare metal security bulletin High CVE-2024-26924
Google.webp 2024-07-18 17:31:38 GCP-2024-043 (lien direct) Published: 2024-07-16Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26921 For instructions and more details, see the following bulletins: GKE security bulletin GDC software for VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GDC software for bare metal security bulletin High CVE-2024-26921
Google.webp 2024-07-18 17:31:38 GCP-2024-029 (lien direct) Published: 2024-05-14Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26642 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-26642
Google.webp 2024-07-18 17:31:38 GCP-2024-033 (lien direct) Published: 2024-06-10Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:CVE-2022-23222 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2022-23222
Google.webp 2024-07-18 17:31:38 GCP-2024-027 (lien direct) Published: 2024-05-08Updated: 2024-05-09, 2024-05-15Description Description Severity Notes 2024-05-15 Update: Added patch versions for GKE Ubuntu node pools. 2024-05-09 Update: Corrected severity from Medium to High and clarified that GKE Autopilot clusters in the default configuration are not impacted. The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26808 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-26808
Google.webp 2024-07-18 17:31:38 GCP-2024-028 (lien direct) Published: 2024-05-13Updated: 2024-05-22Description Description Severity Notes 2024-05-22 Update: Added patch versions for Ubuntu The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26581 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-26581
Google.webp 2024-07-18 17:31:38 GCP-2024-041 (lien direct) Published: 2024-07-08Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2023-52654CVE-2023-52656 For instructions and more details, see the following bulletins: GKE security bulletin GDC software for VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GDC software for bare metal security bulletin High CVE-2023-52654 CVE-2023-52656
Google.webp 2024-07-18 17:31:38 GCP-2024-030 (lien direct) Published: 2024-05-15Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2023-52620 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2023-52620
Google.webp 2024-07-18 17:31:38 GCP-2024-044 (lien direct) Published: 2024-07-16Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-36972 For instructions and more details, see the following bulletins: GKE security bulletin GDC software for VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GDC software for bare metal security bulletin High CVE-2024-36972
Google.webp 2024-07-18 17:31:38 GCP-2024-024 (lien direct) Published: 2024-04-25Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26585 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-26585
Google.webp 2024-07-18 17:31:38 GCP-2024-035 (lien direct) Published: 2024-06-12Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26584 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-26584
Google.webp 2024-07-18 17:31:38 GCP-2024-042 (lien direct) Published: 2024-07-15Updated: 2024-07-18Description Description Severity Notes 2024-07-18 Update: Clarified that Autopilot clusters in the default configuration aren't impacted. The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2024-26809 For instructions and more details, see the following bulletins: GKE security bulletin GDC software for VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GDC software for bare metal security bulletin High CVE-2024-26809
Google.webp 2024-07-18 17:31:38 GCP-2024-036 (lien direct) Published: 2024-06-18Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes:CVE-2024-26584 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-26584
Google.webp 2024-07-18 17:31:38 GCP-2024-017 (lien direct) Published: 2024-03-06Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes:CVE-2023-3611 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2023-3611
Google.webp 2024-07-01 10:16:50 GCP-2024-040 (lien direct) Publié: 2024-07-01 Description Description Gravité notes Une vulnérabilité d'exécution du code distant, CVE-2024-6387 , a récemment été découvert dans OpenSSH.La vulnérabilité exploite une condition de course qui peut être utilisée pour obtenir l'accès à un shell distant, permettant aux attaquants d'obtenir un accès root.Au moment de la publication, l'exploitation est censée être difficile et prendre plusieurs heures par machine attaqué.Nous ne connaissons aucune tentative d'exploitation. Pour les instructions et plus de détails, consultez les bulletins suivants: Bulletin de sécurité du moteur de calcul bulletin de sécurité GKE logiciel GDC pour VMware Security Bulletin gke sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur logiciel GDC pour le bulletin de sécurité en métal nu bulletin de sécurité du moteur VMware Google Cloud critique CVE-2024-6387
Published: 2024-07-01Description Description Severity Notes A remote code execution vulnerability, CVE-2024-6387, was recently discovered in OpenSSH. The vulnerability exploits a race condition that can be used to obtain access to a remote shell, enabling attackers to gain root access. At the time of publication, exploitation is believed to be difficult and take several hours per machine being attacked. We are not aware of any exploitation attempts. For instructions and more details, see the following bulletins: Compute Engine security bulletin GKE security bulletin GDC software for VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GDC software for bare metal security bulletin Google Cloud VMware Engine security bulletin Critical CVE-2024-6387 		Vulnerability Cloud
Google.webp 2024-06-18 21:50:42 GCP-2024-037 (lien direct) Publié: 2024-06-18 Description Gravité Remarques VMware a divulgué plusieurs vulnérabilités dans VMSA-2024-0012 qui ont un impact sur les composants vCenter déployés dans les environnements clients. Cloud Customer Care Impact La vulnérabilité peut être exploitée en accédant à des ports spécifiques dans le serveur vCenter.Google a déjà bloqué les ports vulnérables sur VCenter Server, ce qui empêche les exploits potentiels de cette vulnérabilité. En outre, Google garantit que tous les déploiements futurs de vCenter ne sont pas exposés à cette vulnérabilité. Que dois-je faire? Aucune autre action n'est requise pour le moment. critique CVE-2024-37079 CVE-2024-37080 CVE-2024-37081 Published: 2024-06-18 Description Severity Notes VMware disclosed multiple vulnerabilities in VMSA-2024-0012 that impact vCenter components deployed in customer environments. Cloud Customer Care impact The vulnerability can be exploited by accessing specific ports in vCenter Server. Google has already blocked the vulnerable ports on vCenter server, which prevents any potential exploits of this vulnerability. In addition, Google ensures all future deployments of vCenter are not exposed to this vulnerability. What should I do? No further action is required at this time. Critical CVE-2024-37079 CVE-2024-37080 CVE-2024-37081 Vulnerability
Google.webp 2024-06-04 17:39:22 GCP-2024-032 (lien direct) Publié: 2024-06-04 Description Description Gravité notes Les CVE suivants exposent le maillage de service cloud aux vulnérabilités exploitables: CVE-2024-23326: Envoy accepte incorrectement la réponse HTTP 200 pour la saisie du mode de mise à niveau. CVE-2024-32974: Crash in EnvoyquicserServerStream :: OninitialHeasterComplete (). CVE-2024-32975: Crash in QuicheDataReader :: peekvarint62Length (). CVE-2024-32976: boucle sans fin lors de la décompression des données de brotli avec une entrée supplémentaire. CVE-2024-34362: Crash (use-après-libre) dans EnvoyquicserServerStream. CVE-2024-34363: Crash en raison de l'exception de Nlohmann JSON non cambrée. CVE-2024-34364: Vector Oom Envoy de HTTP Async Client avec tampon de réponse illimité pour la réponse miroir. Pour les instructions et plus de détails, consultez le Cloud Service Mesh Security Bulletin . High cve-2024-23326 CVE-2024-32974 CVE-2024-32975 CVE-2024-32976 CVE-2024-34362 CVE-2024-34363 CVE-2024-34364
Published: 2024-06-04Description Description Severity Notes The following CVEs expose Cloud Service Mesh to exploitable vulnerabilities: CVE-2024-23326: Envoy incorrectly accepts HTTP 200 response for entering upgrade mode. CVE-2024-32974: Crash in EnvoyQuicServerStream::OnInitialHeadersComplete(). CVE-2024-32975: Crash in QuicheDataReader::PeekVarInt62Length(). CVE-2024-32976: Endless loop while decompressing Brotli data with extra input. CVE-2024-34362: Crash (use-after-free) in EnvoyQuicServerStream. CVE-2024-34363: Crash due to uncaught nlohmann JSON exception. CVE-2024-34364: Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response. For instructions and more details, see the Cloud Service Mesh security bulletin. High CVE-2024-23326 CVE-2024-32974 CVE-2024-32975 CVE-2024-32976 CVE-2024-34362 		Vulnerability Cloud
Google.webp 2024-05-24 20:49:53 GCP-2024-031 (lien direct) Publié: 2024-05-24 Description Description Gravité notes Une nouvelle vulnérabilité (CVE-2024-4323) a été découverte à couramment qui pourrait entraîner une exécution de code distante.Les versions de bit fluide 2.0.7 à 3.0.3 sont affectées. gke, gke sur vmware, gke sur AWS, gke sur azure et gke sur ne pas en métal nu \\ 't à utiliser une version vulnérable de CluentBit et sont non affectés . Pour les instructions et plus de détails, consultez les bulletins suivants: GKE Sécurité Bulletin GKE sur le bulletin de sécurité VMware gke sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur GKE sur le bulletin de sécurité Bare Metal Aucun CVE-2024-4323 Published: 2024-05-24Description Description Severity Notes A new vulnerability (CVE-2024-4323) has been discovered in Fluent Bit that could result in remote code execution. Fluent Bit versions 2.0.7 through 3.0.3 are affected. GKE, GKE on VMware, GKE on AWS, GKE on Azure, and GKE on Bare Metal don\'t use a vulnerable version of Fluent Bit and are unaffected. For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin None CVE-2024-4323 Vulnerability Cloud
Google.webp 2024-04-24 21:21:38 GCP-2024-023 (lien direct) Publié: 2024-04-24 Description Description Gravité notes Les CVE suivants exposent le maillot de service Anthos aux vulnérabilités exploitables: CVE-2024-27919: HTTP / 2: épuisement de la mémoire due à l'inondation du cadre de continuation. CVE-2024-30255: HTTP / 2: épuisement du processeur en raison de l'inondation du cadre de continuation CVE-2024-32475: terminaison anormale lors de l'utilisation de \\ 'auto_sni \' avec \\ ': l'autorité \' en tête de plus de 255 caractères. CVE-2023-45288: Les cadres de continuation HTTP / 2 peuvent être utilisés pour les attaques DOS. Pour les instructions et plus de détails, consultez le Anthos Service Mesh Security Bulletin . High cve-2024-27919 CVE-2024-30255 CVE-2024-32475 CVE-2023-45288 Published: 2024-04-24Description Description Severity Notes The following CVEs expose Anthos Service Mesh to exploitable vulnerabilities: CVE-2024-27919: HTTP/2: memory exhaustion due to CONTINUATION frame flood. CVE-2024-30255: HTTP/2: CPU exhaustion due to CONTINUATION frame flood CVE-2024-32475: Abnormal termination when using \'auto_sni\' with \':authority\' header longer than 255 characters. CVE-2023-45288: HTTP/2 CONTINUATION frames can be utilized for DoS attacks. For instructions and more details, see the Anthos Service Mesh security bulletin. High CVE-2024-27919 CVE-2024-30255 CVE-2024-32475 CVE-2023-45288 Vulnerability Cloud
Google.webp 2024-04-03 21:22:02 GCP-2024-022 (lien direct) Publié: 2024-04-03 Description Description Gravité notes Une vulnérabilité de déni de service (DOS) (CVE-2023-45288) a récemment été découverte dans plusieurs implémentations du protocole HTTP / 2, y compris le serveur HTTP Golang utilisé par Kubernetes.La vulnérabilité pourrait conduire à un DOS du plan de contrôle Google Kubernetes Engine (GKE). Pour les instructions et plus de détails, consultez les bulletins suivants: Bulletin de sécurité gke GKE sur le bulletin de sécurité VMware gke sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur GKE sur le bulletin de sécurité Bare Metal High CVE-2023-45288 Published: 2024-04-03Description Description Severity Notes A Denial-of-Service (DoS) vulnerability (CVE-2023-45288) was recently discovered in multiple implementations of the HTTP/2 protocol, including the golang HTTP server used by Kubernetes. The vulnerability could lead to a DoS of the Google Kubernetes Engine (GKE) control plane. For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2023-45288 Vulnerability Cloud
Google.webp 2024-04-03 16:47:44 GCP-2024-021 (lien direct) Publié: 2024-04-03 Description Description Gravité notes Le moteur de calcul n'est pas affecté par CVE-2024-3094 , qui affecte les versions 5.6.0 et 5.6.1 du package XZ-Utils dans la bibliothèque Liblzma, et pourrait conduire au compromis de l'utilitaire OpenSSH. Pour plus de détails, voir le Cloud
Google.webp 2024-04-02 17:03:04 GCP-2024-020 (lien direct) Publié: 2024-04-02 Description Description Gravité notes Les chercheurs ont découvert une vulnérabilité ( CVE-2023-48022 ) dans Vulnerability Threat Cloud
Google.webp 2024-03-05 23:25:43 GCP-2024-016 (lien direct) Publié: 2024-03-05 Vulnerability
Google.webp 2024-02-13 17:28:33 GCP-2024-009 (lien direct) Publié: 2024-02-13 Description Description Gravité notes Le 13 février 2024, AMD a révélé deux vulnérabilités affectant SEV-SNP sur les processeurs EPYC sur la base des noyaux zen de la troisième génération "Milan" et de la quatrième génération "GenoA".Les vulnérabilités permettent aux attaquants privilégiés d'accéder aux données périmées des invités ou de provoquer une perte d'intégrité des clients. Google a appliqué des correctifs aux actifs affectés, y compris Google Cloud, pour s'assurer que les clients sont protégés.À l'heure actuelle, aucune preuve d'exploitation n'a été trouvée ou signalée à Google. Que dois-je faire? Aucune action client n'est requise.Les correctifs ont déjà été appliqués à la flotte Google Server pour Google Cloud, y compris le moteur de calcul. Pour plus d'informations, voir AMD Security Advisory AMD-SN-3007 . modéré CVE-2023-31346 CVE-2023-31347 Published: 2024-02-13Description Description Severity Notes On February 13, 2024, AMD disclosed two vulnerabilities affecting SEV-SNP on EPYC CPUs based on third generation "Milan" and fourth generation "Genoa" Zen cores. The vulnerabilities allow privileged attackers to access stale data from guests or cause a loss of guest integrity. Google has applied fixes to affected assets, including Google Cloud, to ensure customers are protected. At this time, no evidence of exploitation has been found or reported to Google. What should I do? No customer action is required. Fixes have already been applied to the Google server fleet for Google Cloud, including Compute Engine. For more information, see AMD security advisory AMD-SN-3007. Moderate CVE-2023-31346 CVE-2023-31347 Vulnerability Cloud
Google.webp 2024-02-12 22:37:28 GCP-2024-008 (lien direct) Publié: 2024-02-12 Description Description Gravité notes CVE-2023-5528 Permet à un attaquant de créer des pods et des volumes persistants sur les nœuds Windows d'une manière qui permet l'escalade du privilège d'administration sur ces nœuds. pour les instructions et plus de détails, voir leBulletins suivant: GKE Sécurité Bulletin Bulletin Bulletin Bulletin Bulletin Bulletin Bulletin de sécurité GKE GKE GKE gke sur le bulletin de sécurité VMware gke sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur GKE sur le bulletin de sécurité en métal nu High CVE-2023-5528 Published: 2024-02-12Description Description Severity Notes CVE-2023-5528 allows an attacker to create pods and persistent volumes on Windows nodes in a way that enables admin privilege escalation on those nodes. For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2023-5528 Cloud
Google.webp 2024-02-08 23:50:05 GCP-2024-007 (lien direct) Publié: 2024-02-08 Description Description Gravité notes Les CVE suivants exposent le maillage de service Anthos aux vulnérabilités exploitables: CVE-2024-23322: Envoyé se bloque lorsque le ralenti et les demandes par essai se produisent dans l'intervalle de retour. CVE-2024-23323: utilisation excessive du processeur lorsque le matrice du modèle URI est configuré en utilisant Regex. CVE-2024-23324: L'autorisation externe peut être contournée lorsque le filtre de protocole proxy définit les métadonnées UTF-8 non valides. Envoyé se bloque lors de l'utilisation d'un type d'adresse qui n'est pas pris en charge par l'OS. CVE-2024-23327: Crash en protocole proxy lorsque le type de commande est local . Pour les instructions et plus de détails, voir le Bulletin de service de service Anthos . High cve-2024-23322 CVE-2024-23323 CVE-2024-23324 CVE-2024-23325 CVE-2024-23327 Published: 2024-02-08Description Description Severity Notes The following CVEs expose Anthos Service Mesh to exploitable vulnerabilities: CVE-2024-23322: Envoy crashes when idle and requests per try timeout occur within the backoff interval. CVE-2024-23323: Excessive CPU usage when URI template matcher is configured using regex. CVE-2024-23324: External authorization can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata. Envoy crashes when using an address type that isn\'t supported by the OS. CVE-2024-23327: Crash in proxy protocol when command type is LOCAL. For instructions and more details, see the Anthos Service Meshsecurity bulletin. High CVE-2024-23322 CVE-2024-23323 CVE-2024-23324 CVE-2024-23325 CVE-2024-23327 Vulnerability Cloud
Google.webp 2024-02-05 21:06:18 GCP-2024-006 (lien direct) Publié: 2024-02-5 Description Description Gravité notes Lorsqu'un proxy de gestion de l'API APIGEE se connecte à un Target Endpoint ou serveur cible , le proxy n'effectue pas la validation du nom d'hôtepour le certificat présenté par le point de terminaison cible ou le serveur cible par défaut.Si la validation du nom d'hôte n'est pas activée à l'aide de l'une des options suivantes, les proxys APIGEE se connectant à un point de terminaison cible ou un serveur cible peuvent être à risque pour une attaque de l'homme au milieu d'un utilisateur autorisé.Pour plus d'informations, consultez Configuration des TLs de bord au backend (nuage et privéCloud) . Pour les instructions et plus de détails, consultez le Bulletin de sécurité de l'apigan . High Published: 2024-02-5Description Description Severity Notes When an Apigee API Management proxy connects to a target endpoint or target server, the proxy does not perform hostname validation for the certificate presented by the target endpoint or target server by default. If hostname validation is not enabled using one of the following options, Apigee proxies connecting to a target endpoint or target server may be at risk for a man-in-the-middle attack by an authorized user. For more information, see Configuring TLS from Edge to the backend (Cloud and Private Cloud).For instructions and more details, see the Apigee security bulletin. High Cloud
Google.webp 2024-01-31 20:08:14 GCP-2024-005 (lien direct) Publié: 2024-01-31 Description Description Gravité notes Une vulnérabilité de sécurité, CVE-2024-21626, a été découverte dans runc où un utilisateur avec la permission de créer des pods sur le système d'exploitation optimisé et les nœuds ubuntu à conteneur pourraitêtre en mesure d'accéder à un accès complet au système de fichiers de nœud. Pour les instructions et plus de détails, consultez les bulletins suivants: Bulletin de sécurité gke gke sur le bulletin de sécurité VMware gke sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur gke sur le bulletin de sécurité en métal nus High CVE-2024-21626 Published: 2024-01-31Description Description Severity Notes A security vulnerability, CVE-2024-21626, has been discovered in runc where a user with permission to create Pods on Container-Optimized OS and Ubuntu nodes might be able to gain full access to the node filesystem. For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2024-21626 Vulnerability Cloud
Google.webp 2024-01-20 01:07:13 GCP-2024-003 (lien direct) Publié: 2024-01-19 Description Description Gravité notes Nous avons identifié plusieurs clusters où les utilisateurs ont accordé des privilèges Kubernetes au groupe : groupe authentifié , qui inclut tous les utilisateurs avec un compte Google.Ces types de liaisons sont non recommandée , car elles violent les violations de la violence.Principe du moindre privilège et accès à de très grands groupes d'utilisateurs.Voir les conseils sous \\ 'que dois-je faire \' Pour des instructions sur la façon de trouver ces types de liaisons. Pour les instructions et plus de détails, consultez les bulletins suivants: Bulletin de sécurité GKE moyen Published: 2024-01-19Description Description Severity Notes We have identified several clusters where users have granted Kubernetes privileges to the system:authenticated group, which includes all users with a Google account. These types of bindings are not recommended, as they violate the principle of least privilege and grant access to very large groups of users. See guidance under \'What should I do\' for instructions on how to find these types of bindings. For instructions and more details, see the following bulletins: GKE security bulletin Medium Cloud
Google.webp 2024-01-17 18:46:13 GCP-2024-001 (lien direct) Publié: Description Vulnerability
Google.webp 2023-12-20 18:06:55 GCP-2023-049 (lien direct) Publié: 2023-12-20 Description Description Gravité notes Les vulnérabilités suivantes ont été découvertes dans le noyau Linux qui peut conduire à une escalade de privilège sur le système d'exploitation optimisé et les nœuds Ubuntu. CVE-2023-3090 Pour les instructions et plus de détails, consultez les bulletins suivants: Bulletin de sécurité GKE GKE sur le bulletin de sécurité VMware gke sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur gke sur le bulletin de sécurité nue High CVE-2023-3090 Published: 2023-12-20Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes.CVE-2023-3090 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2023-3090 Vulnerability Cloud
Google.webp 2023-12-15 13:31:44 GCP-2023-048 (lien direct) Publié: 2023-12-15 Description Description Gravité notes Les vulnérabilités suivantes ont été découvertes dans le noyau Linux qui peut conduire à une escalade de privilège sur le système d'exploitation optimisé par le conteneur et les nœuds Ubuntu. CVE-2023-3390 Pour les instructions et plus de détails, consultez les bulletins suivants: Bulletin de sécurité GKE GKE sur le bulletin de sécurité VMware gke sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur GKE sur le bulletin de sécurité Bare Metal High CVE-2023-3390 Published: 2023-12-15Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes.CVE-2023-3390 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin High CVE-2023-3390 Vulnerability Cloud
Google.webp 2023-12-14 17:28:06 GCP-2023-047 (lien direct) Publié: 2023-12-14 Description Description Gravité notes Un attaquant qui a compromis le conteneur de journalisation de bit Cluent pourrait combiner cet accès avec des privilèges élevés requis par Anthos Service Mesh (sur des clusters qui l'ont permis) de dégénérer les privilèges dans le cluster. Pour les instructions et plus de détails, consultez les bulletins suivants: Bulletin de sécurité GKE GKE sur le bulletin de sécurité VMware gke sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur gke sur le bulletin de sécurité nue moyen Published: 2023-12-14Description Description Severity Notes An attacker who has compromised the Fluent Bit logging container could combine that access with high privileges required by Anthos Service Mesh (on clusters that have enabled it) to escalate privileges in the cluster. For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin GKE on Bare Metal security bulletin Medium Cloud
Google.webp 2023-11-22 18:13:21 GCP-2023-039 (lien direct) Publié: 2023-11-06 Mise à jour: 2023-11-21, 2023-11-16 Description
Google.webp 2023-11-22 18:13:21 GCP-2023-038 (lien direct) Publié: 2023-11-06 Mise à jour: 2023-11-21 Description
Google.webp 2023-11-22 18:13:21 GCP-2023-041 (lien direct) Publié: 2023-11-08 Mise à jour: 2023-11-21 Description
Google.webp 2023-11-22 18:13:21 GCP-2023-046 (lien direct) Publié: 2023-11-22 Description
Google.webp 2023-11-22 18:13:21 GCP-2023-037 (lien direct) Publié: 2023-11-06 Mise à jour: 2023-11-21 Description
Google.webp 2023-11-22 18:13:21 GCP-2023-042 (lien direct) Publié: 2023-11-13 Mise à jour: 2023-11-15 Description
Google.webp 2023-11-22 18:13:21 GCP-2023-040 (lien direct) Publié: 2023-11-06 Mise à jour: 2023-11-21 Description
Google.webp 2023-11-22 18:13:21 GCP-2023-045 (lien direct) Publié: 2023-11-20 Description Description Gravité notes Les vulnérabilités suivantes ont été découvertes dans le noyau Linux qui peut conduire à une escalade de privilège sur le système d'exploitation optimisé par le conteneur et les nœuds Ubuntu. CVE-2023-5197 Pour les instructions et plus de détails, consultez les bulletins suivants: Bulletin de sécurité GKE GKE sur VMware Security Bulletin GKE sur le bulletin de sécurité AWS gke sur le bulletin de sécurité azur google distribué virtuel du nuage pour le bulletin de sécurité des métaux nus High CVE-2023-5197 Published: 2023-11-20Description Description Severity Notes The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS and Ubuntu nodes.CVE-2023-5197 For instructions and more details, see the following bulletins: GKE security bulletin GKE on VMware security bulletin GKE on AWS security bulletin GKE on Azure security bulletin Google Distributed Cloud Virtual for Bare Metal security bulletin High CVE-2023-5197
Google.webp 2023-11-15 19:19:05 GCP-2023-044 (lien direct) Publié: 2023-11-15 Description AMD-SN-3002:" AMD Server Vulnérabilités & # 8211; Novembre 2023 ". modéré cve.-2022-23820 cve-2021-46774 cve-2023-20533 cve-2023-20519 cve-2023-20592 cve-2023-20566 cve-2022-23830 cve-2023-20526 cve-2021-26345
Published: 2023-11-15Description Description Severity Notes On November 14, AMD disclosed multiple vulnerabilities that impact various AMD server CPUs. Specifically, the vulnerabilities impact EPYC Server CPUs leveraging Zen core generation 2 "Rome," gen 3 "Milan," and gen 4 "Genoa." Google has applied fixes to affected assets, including Google Cloud, to ensure customers are protected. At this time, no evidence of exploitation has been found or reported to Google. What should I do? No customer action is required. Fixes have already been applied to the Google server fleet for Google Cloud, including Google Compute Engine. What vulnerabilities are being addressed? The patch mitigated the following vulnerabilities: CVE-2022-23820 CVE-2021-46774 CVE-2023-20533 CVE		 Vulnerability Cloud
Google.webp 2023-11-13 22:41:17 GCP-2023-043 (lien direct) Publié: 2023-11-14 Description Vulnerability Cloud
Google.webp 2023-10-31 04:09:51 GCP-2023-036 (lien direct) Publié: 2023-10-30 Description Vulnerability Cloud
Last update at: 2024-07-18 18:07:35
See our sources.
My email:

To see everything: Our RSS (filtrered) Twitter