Our news and updates

In Couchbase Server versions before 7.2.5 and 7.6.0 before 7.6.1 a low severity vulnerability CVE-2024-37034 was detected. This vulnerability allows attackers to intercept and potentially steal sensitive information because the credentials are not properly secured. To fix this problem, users should upgrade Couchbase Server to versions 7.2.5 and 7.6.1. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-37034.

In OpenShift versions 4.12.0 prior to 4.12.12, 4.13.0 prior to 4.13.5 and 4.14.0 prior to 4.14.0 a medium severity vulnerability CVE-2024-7128 was detected. This allows attackers to access and potentially steal data because the system is not properly checking user credentials. To fix this problem, users should upgrade to OpenShift versions 4.12.13, 4.13.6, and 4.14.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7128.

In GitLab EE versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 a medium severity vulnerability CVE-2024-5067 was detected. Certain project-level analytics settings could be visible in the DOM to group members with Developer or higher roles. To address this issue users should upgrade GitLab EE to versions 17.2.1, 17.1.3 or 17.0.5. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-5067.

In OpenProject versions before 14.3.0 a medium severity vulnerability CVE-2024-41801 was detected. This vulnerability allows attackers to redirect users with a fake HOST header, affecting default installations. Upgrade to version 14.3.0 to fix this by rejecting invalid hostnames. If upgrading isn’t possible, use mod_security for Apache, adjust Host and X-Forwarded-Host headers manually, or apply a patch for older versions. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-41801.

In the Openshift console a medium severity vulnerability CVE-2024-7079 was detected. The /API/helm/verify endpoint is not secured properly. As a result, unauthenticated users are able to access this endpoint, potentially leading to security risks. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7079.

In OpenProject versions prior to 14.3.0 a medium severity vulnerability CVE-2024-41801 was detected. This vulnerability allows attackers to redirect users to fake sites to steal their credentials. To fix this problem, users should upgrade OpenProject to version 14.3.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-41801.

In OpenShift version 3.11 a high severity vulnerability CVE-2024-7079 was detected. This vulnerability allows attackers to access the system without logging in, which could expose sensitive information. To fix this problem, users should upgrade OpenShift to version 4.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7079.

In Setuptools is a widely-used Python library for packaging, distributing, and installing Python projects a high severity vulnerability CVE-2024-6345 was detected. A vulnerability in the `package_index` module of pypa/setuptools (up to version 69.1.1) allows remote code execution through its download functions, which are susceptible to code injection with user-controlled inputs like package URLs. To address this issue users should upgrade to version 70.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6345.

In GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 a low severity vulnerability CVE-2024-0231 was detected. This vulnerability allows attackers to create a specially crafted repository import to redirect code changes to the wrong place. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-0231.