Developer Tools

In GitLab EE versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 a medium severity vulnerability CVE-2024-5067 was detected. Certain project-level analytics settings could be visible in the DOM to group members with Developer or higher roles. To address this issue users should upgrade GitLab EE to versions 17.2.1, 17.1.3 or 17.0.5. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-5067.

In the Openshift console a medium severity vulnerability CVE-2024-7079 was detected. The /API/helm/verify endpoint is not secured properly. As a result, unauthenticated users are able to access this endpoint, potentially leading to security risks. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7079.

In OpenShift version 3.11 a high severity vulnerability CVE-2024-7079 was detected. This vulnerability allows attackers to access the system without logging in, which could expose sensitive information. To fix this problem, users should upgrade OpenShift to version 4.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7079.

In GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 a low severity vulnerability CVE-2024-0231 was detected. This vulnerability allows attackers to create a specially crafted repository import to redirect code changes to the wrong place. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-0231.

In Openshift Container Storage a high severity vulnerability CVE-2024-1394 was detected. A memory leak in Golang’s RSA encryption code can cause the system to run out of resources when given harmful data. This problem occurs in the `rsa.go` file at line 113 of the `github.com/golang-fips/openssl/openssl` package because the `pkey` and `ctx` variables aren’t properly released when there’s an error. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-1394.

In Zowe in Command Line Interface (CLI) a medium severity vulnerability CVE-2024-6833 was detected. This vulnerability allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation. To address this issue users should upgrade to version 7.23.5 or higher. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6833.

In Kubernetes versions 1.27.15 and prior, 1.28.11 and prior, 1.29.6 and prior, 1.30.2 and prior a medium severity vulnerability CVE-2024-5321 was detected. This vulnerability allows attackers to modify contained logs. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-5321/.

In Zowe in Command Line Interface (CLI) a medium severity vulnerability CVE-2024-6916 was detected. This vulnerability allows local, privileged actors to display securely stored properties in cleartext within a terminal using the ‘–show-inputs-only’ flag. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6916.

In Zowe in the API Mediation Layer (APIML) Spring Cloud Gateway a critical severity vulnerability CVE-2024-6834 was detected. This vulnerability allows a user to exploit Zowe’s client certificate to sign proxied requests, providing unauthorized access to endpoints that normally require internal client certificates. Consequently, an attacker can manage various components and intercept all communication, including user credentials. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6834.