Adam Korcz

A client can send a WebSocket frame containing an unknown opcode and an excessively large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass standard maximum frame size checks, leading the system to attempt a large memory allocation before the opcode is validated. This process can exhaust the JVM heap, potentially causing a denial of service.

An attacker connecting to an open Erlang TCP port using the inet driver with `{packet,4}` mode can trigger a signed overflow due to an incorrect packet length calculation. This allows the receive buffer to overflow into the VM allocator area and beyond by up to 2 GB, which typically corrupts the allocator metadata footer and subsequent blocks, leading to a BEAM VM crash. Achieving Remote Code Execution through this method is considered extremely unfeasible.

Name of the Vulnerable Software and Affected Versions: body-parser versions prior to 1.20.3 Description: The issue concerns a denial of service vulnerability when URL encoding is enabled. A malicious actor can use a specially crafted payload to flood the server with a large number of requests, resulting in denial of service. Recommendations: For versions prior to 1.20.3, update to version 1.20.3 to resolve the issue. As a temporary workaround, consider disabling URL encoding until a patch is available. Restrict access to the server to minimize the risk of exploitation.

Helm is a tool for managing Charts, pre-configured Kubernetes resources. The issue results in Uncontrolled Resource Consumption, leading to Denial of Service. Input to functions in the ` strvals ` package can cause a stack overflow, which cannot be recovered from in Go. Applications using functions from the ` strvals ` package in the Helm SDK can suffer a Denial of Service attack when the package panics. The ` strvals ` package contains a parser that turns strings into Go structures, and some string inputs can cause array data structures to be created, leading to a stack overflow. The Helm Client will panic with input to flags like `--set`, `--set-string`, and other value setting flags that cause a stack overflow.

The issue concerns a NULL Pointer Dereference in the `chartutil` package that can cause a segmentation violation. This package contains a parser that loads a JSON Schema validation file, which can be used by the Helm client to validate chart values. Certain schema files can cause array data structures to be created, leading to a memory violation. This can result in a Denial of Service when the input causes a panic that cannot be recovered from. The Helm client will panic with a schema file that causes a memory violation panic, but since Helm is not a long-running service, the panic will not affect future uses of the Helm client.

The issue is related to the strvals package in the Helm SDK, which contains a parser that turns strings into Go structures. Some string inputs can cause array data structures to be created, leading to an out of memory panic. Applications that use the strvals package to parse user-supplied input can suffer a Denial of Service when that input causes a panic that cannot be recovered from. The Helm Client will panic with input to `--set`, `--set-string`, and other value setting flags that causes an out of memory panic. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Argo Events is an event-driven workflow automation framework for Kubernetes. The issue arises from the use of the deprecated `ioutil.ReadAll()` function in several `HandleRoute` endpoints, which reads all data into memory. This allows an attacker to send a large request to the Argo Events server, causing it to crash and resulting in a denial of service. The affected endpoints can be used to cause a denial of service. Events sources susceptible to this out-of-memory denial-of-service attack include AWS SNS, Bitbucket, Gitlab, Slack, Storagegrid, and Webhook.

A vulnerability in CRI-O causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and it is read in a manner where the entire file corresponding to the output of the command is read in. Thus, if the output of the command is large, it is possible to exhaust the memory or the disk space of the node when CRI-O reads the output of the command. The highest threat from this vulnerability is system availability.

The issue is related to the kustomize-controller, a Kubernetes operator for running continuous delivery pipelines. It allows users who can create Kubernetes Secrets, Service Accounts, and Flux Kustomization objects to execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges. The vulnerability affects multitenant environments where non-admin users have permissions to create Flux Kustomization objects.