Security Bulletin Changes #3120

karl-cardenas-coding · 2024-06-18T17:45:30Z

Describe the Change

This PR updates the security bulletin index page.

Changed Pages

💻 Preview URL for Page

Security Bulletins

Jira Tickets

🎫 DOC-1241

Backports

Can this PR be backported?

Yes. Remember to add the relevant backport labels to your PR.
No. Please leave a short comment below about why this PR cannot be backported.

netlify · 2024-06-18T17:45:48Z

✅ Deploy Preview for docs-spectrocloud ready!

Name	Link
🔨 Latest commit	`ebb13f0`
🔍 Latest deploy log	https://app.netlify.com/sites/docs-spectrocloud/deploys/669800ea853180000871baa4
😎 Deploy Preview	https://deploy-preview-3120--docs-spectrocloud.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

github-actions · 2024-07-17T16:03:50Z

docs/docs-content/security-bulletins/reports/ghsa-m425-mq94-257g.md

+
+| CVE ID                                                                   | Last Update | NIST CVE Summary                                                                                                                                                                                                                                                                                   | Our Official Summary                                                                                                                                                                                                                        | CVE Severity                                             | Status  |
+| ------------------------------------------------------------------------ | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ------- |
+| [GHSA-m425-mq94-257g](https://github.com/advisories/GHSA-m425-mq94-257g) | 10/25/23    | The affected releases of gRPC-Go, it is possible for an attacker to send HTTP/2 requests, cancel them, and send subsequent requests, which is valid by the HTTP/2 protocol, but would cause the gRPC-Go server to launch more concurrent method handlers than the configured maximum stream limit. | CCVE exists in coredns that’s being used in k8s 1.28.11. Affects only k8s version 1.28.11. For customer workload clusters, workaround is to use k8s version 1.29+. For Palette Self Hosted cluster, a future release will upgrade to 1.29+. | [7.5](https://github.com/advisories/GHSA-m425-mq94-257g) | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'coredns'?

github-actions · 2024-07-17T16:03:50Z

docs/docs-content/security-bulletins/reports/prisma-2022-0227.md

+
+# CVE Details
+
+We provide the most up-to-date information below.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'we' instead of 'We'.

github-actions · 2024-07-17T16:03:50Z

docs/docs-content/security-bulletins/reports/prisma-2022-0227.md

+
+| CVE ID                                                                     | Last Update | NIST CVE Summary                                                                                                                                                                                                                                                        | Our Official Summary                                                                                    | CVE Severity | Status  |
+| -------------------------------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------ | ------- |
+| [PRISMA-2022-0227](https://github.com/kubernetes/kubernetes/issues/120604) | 7/16/24     | github.com/emicklei/go-restful/v3 module prior to v3.10.0 is vulnerable to Authentication Bypass by Primary Weakness. There is an inconsistency in how go-restful parses URL paths. This inconsistency could lead to several security check bypass in a complex system. | The CVE reported in vsphere-csi 3.2.0, and Kubernetes 1.28.11. Govulncheck reports it as non-impacting. | N/A          | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'vSphere' instead of 'vsphere'.

github-actions · 2024-07-17T16:03:50Z

docs/docs-content/security-bulletins/reports/prisma-2022-0227.md

+
+| CVE ID                                                                     | Last Update | NIST CVE Summary                                                                                                                                                                                                                                                        | Our Official Summary                                                                                    | CVE Severity | Status  |
+| -------------------------------------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- | ------------ | ------- |
+| [PRISMA-2022-0227](https://github.com/kubernetes/kubernetes/issues/120604) | 7/16/24     | github.com/emicklei/go-restful/v3 module prior to v3.10.0 is vulnerable to Authentication Bypass by Primary Weakness. There is an inconsistency in how go-restful parses URL paths. This inconsistency could lead to several security check bypass in a complex system. | The CVE reported in vsphere-csi 3.2.0, and Kubernetes 1.28.11. Govulncheck reports it as non-impacting. | N/A          | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'Govulncheck'?

github-actions · 2024-07-17T16:03:50Z

docs/docs-content/security-bulletins/reports/cve-2021-45079.md

+
+# CVE Details
+
+We provide the most up-to-date information below.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'we' instead of 'We'.

github-actions · 2024-07-17T16:03:51Z

docs/docs-content/security-bulletins/reports/cve-2023-0286.md

+
+# CVE Details
+
+We provide the most up-to-date information below.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'we' instead of 'We'.

github-actions · 2024-07-17T16:03:51Z

docs/docs-content/security-bulletins/reports/cve-2023-0286.md

+
+| CVE ID                                                          | Last Update | NIST CVE Summary                                                                                                                                                                                                                                                                                                                                                                                               | Our Official Summary                                                                                                                              | CVE Severity                                          | Status  |
+| --------------------------------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ------- |
+| [CVE-2023-0286](https://nvd.nist.gov/vuln/detail/CVE-2023-0286) | 7/16/24     | There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. | This is a false positive reported by twistlock only. We have confirmed this CVE is fixed in the FIPS openSSL version that’s being used in VerteX. | [7.4](https://nvd.nist.gov/vuln/detail/CVE-2023-0286) | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'GENERAL_NAME_cmp'?

github-actions · 2024-07-17T16:03:51Z

docs/docs-content/security-bulletins/reports/cve-2023-0286.md

+
+| CVE ID                                                          | Last Update | NIST CVE Summary                                                                                                                                                                                                                                                                                                                                                                                               | Our Official Summary                                                                                                                              | CVE Severity                                          | Status  |
+| --------------------------------------------------------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ------- |
+| [CVE-2023-0286](https://nvd.nist.gov/vuln/detail/CVE-2023-0286) | 7/16/24     | There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an ASN1_STRING. | This is a false positive reported by twistlock only. We have confirmed this CVE is fixed in the FIPS openSSL version that’s being used in VerteX. | [7.4](https://nvd.nist.gov/vuln/detail/CVE-2023-0286) | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'we' instead of 'We'.

github-actions · 2024-07-17T16:03:52Z

docs/docs-content/security-bulletins/security-bulletins.md

@@ -9,26 +9,24 @@ sidebar_custom_props:
 tags: ["security", "cve"]
 ---

-The following are security advisories for Palette and other Spectro Cloud-related resources.
+We aim to provide you with the most up-to-date information about the security of our products and services. No matter


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'we' instead of 'We'.

github-actions · 2024-07-17T16:03:52Z

docs/docs-content/security-bulletins/security-bulletins.md

-| Medium   | 4.0 - 6.9  |
-| High     | 7.0 - 8.9  |
-| Critical | 9.0 - 10.0 |
+We release [security bulletins](./reports/reports.md) on a monthly and ad-hoc basis addressing security vulnerabilities


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'we' instead of 'We'.

github-actions · 2024-07-17T16:30:00Z

docs/docs-content/security-bulletins/reports/reports.md

+
+| CVE ID                                          | Initial Pub Date | Modified Date | Impacted Product & Version | Vulnerability Type                      | CVSS Severity                                            | Status        |
+| ----------------------------------------------- | ---------------- | ------------- | -------------------------- | --------------------------------------- | -------------------------------------------------------- | ------------- |
+| [CVE-2023-52425](./cve-2023-52425.md)           | 02/04/2024       | 06/14/2024    | Palette 4.4.8              | Third-party component: vSphere-CSI      | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425)   | :mag: Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '02/04/2024'.

github-actions · 2024-07-17T16:30:00Z

docs/docs-content/security-bulletins/reports/reports.md

+
+| CVE ID                                          | Initial Pub Date | Modified Date | Impacted Product & Version | Vulnerability Type                      | CVSS Severity                                            | Status        |
+| ----------------------------------------------- | ---------------- | ------------- | -------------------------- | --------------------------------------- | -------------------------------------------------------- | ------------- |
+| [CVE-2023-52425](./cve-2023-52425.md)           | 02/04/2024       | 06/14/2024    | Palette 4.4.8              | Third-party component: vSphere-CSI      | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425)   | :mag: Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '06/14/2024'.

github-actions · 2024-07-17T16:59:44Z

docs/docs-content/security-bulletins/reports/cve-2023-52425.md

+
+| CVE ID                                                            | Last Update | NIST CVE Summary                                                                                                                                                                            | Our Official Summary                      | CVE Severity                                           | Status  |
+| ----------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------------------------------------------------------ | ------- |
+| [CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | 7/16/24     | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | The CVE is reported in vsphere-csi 3.2.0. | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'libexpat'?

github-actions · 2024-07-17T16:59:44Z

docs/docs-content/security-bulletins/reports/cve-2023-52425.md

+
+| CVE ID                                                            | Last Update | NIST CVE Summary                                                                                                                                                                            | Our Official Summary                      | CVE Severity                                           | Status  |
+| ----------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------------------------------------------------------ | ------- |
+| [CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | 7/16/24     | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | The CVE is reported in vsphere-csi 3.2.0. | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'reparsings'?

github-actions · 2024-07-17T16:59:44Z

docs/docs-content/security-bulletins/reports/cve-2023-52425.md

+
+| CVE ID                                                            | Last Update | NIST CVE Summary                                                                                                                                                                            | Our Official Summary                      | CVE Severity                                           | Status  |
+| ----------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- | ------------------------------------------------------ | ------- |
+| [CVE-2023-52425](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | 7/16/24     | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | The CVE is reported in vsphere-csi 3.2.0. | [7.5](https://nvd.nist.gov/vuln/detail/CVE-2023-52425) | Ongoing |


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'vSphere' instead of 'vsphere'.

* docs: DOC-1241 * docs: draft * chore: updated with link * docs: updated disclosures * docs: updated * chore: updated * docs: updated * docs: updates * chore: updates * chore: fix * chore: missing URLs * chore: updated prettier to exclude cve-page * chore: added N/A versus leaving blank * docs: updated CVEs * docs: update * docs: added airgap * docs: fixed minor issue * docs: fix broken URL * docs: updated intro langugae (cherry picked from commit 9bbd508)

vault-token-factory-spectrocloud · 2024-07-17T19:00:50Z

💔 Some backports could not be created

Status	Branch	Result
❌	version-4-0	Backport failed because of merge conflicts You might need to backport the following PRs to version-4-0: - Create, style, and populate the Tutorials section (#2689)
❌	version-3-4	Backport failed because of merge conflicts You might need to backport the following PRs to version-3-4: - chore: DOC-1148 fix missing trailing slash (#2656) - Refactor/restructure cluster & app profiles sections (#1551) - docs: refactor for self-hosted Palette DOC-465 (#1597) - chore: released docs versioning
❌	version-4-1	Backport failed because of merge conflicts You might need to backport the following PRs to version-4-1: - Create, style, and populate the Tutorials section (#2689)
❌	version-4-2	Backport failed because of merge conflicts You might need to backport the following PRs to version-4-2: - chore: add vale rule (#2106)
❌	version-4-3	Backport failed because of merge conflicts
✅	version-4-4

Note: Successful backport PRs will be merged automatically after passing CI.

Manual backport

To create the backport manually run:

backport --pr 3120

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

* docs: DOC-1241 * docs: draft * chore: updated with link * docs: updated disclosures * docs: updated * chore: updated * docs: updated * docs: updates * chore: updates * chore: fix * chore: missing URLs * chore: updated prettier to exclude cve-page * chore: added N/A versus leaving blank * docs: updated CVEs * docs: update * docs: added airgap * docs: fixed minor issue * docs: fix broken URL * docs: updated intro langugae (cherry picked from commit 9bbd508) Co-authored-by: Karl Cardenas <29551334+karl-cardenas-coding@users.noreply.github.com>

* docs: DOC-1241 * docs: draft * chore: updated with link * docs: updated disclosures * docs: updated * chore: updated * docs: updated * docs: updates * chore: updates * chore: fix * chore: missing URLs * chore: updated prettier to exclude cve-page * chore: added N/A versus leaving blank * docs: updated CVEs * docs: update * docs: added airgap * docs: fixed minor issue * docs: fix broken URL * docs: updated intro langugae

docs: DOC-1241

79ee128

karl-cardenas-coding changed the title ~~docs: DOC-1241~~ Security Bulletin Changes Jun 18, 2024

karl-cardenas-coding added 15 commits June 20, 2024 13:50

Merge branch 'master' into DOC-1241

f2f1796

docs: draft

5582ec5

chore: updated with link

0a3f37d

Merge branch 'master' into DOC-1241

78e839d

docs: updated disclosures

49f118f

docs: updated

8057afb

chore: updated

726634d

docs: updated

0898a21

docs: updates

55849a6

chore: updates

c79f20e

chore: fix

3fe4dcd

chore: missing URLs

16ead37

chore: updated prettier to exclude cve-page

fe3da33

chore: added N/A versus leaving blank

ff4f981

docs: updated CVEs

512aa55

karl-cardenas-coding marked this pull request as ready for review July 17, 2024 02:45

karl-cardenas-coding requested a review from a team as a code owner July 17, 2024 02:45

karl-cardenas-coding requested review from yuliiiah, addetz and caroldelwing July 17, 2024 02:45

github-actions bot reviewed Jul 17, 2024

View reviewed changes

docs: fixed minor issue

96c7dc7

github-actions bot reviewed Jul 17, 2024

View reviewed changes

docs: fix broken URL

6088e13

github-actions bot reviewed Jul 17, 2024

View reviewed changes

karl-cardenas-coding and others added 2 commits July 17, 2024 10:05

docs: updated intro langugae

9d6fca2

Merge branch 'master' into DOC-1241

ebb13f0

karl-cardenas-coding merged commit 9bbd508 into master Jul 17, 2024
15 checks passed

karl-cardenas-coding deleted the DOC-1241 branch July 17, 2024 18:59

vault-token-factory-spectrocloud bot mentioned this pull request Jul 17, 2024

[version-4-4] Security Bulletin Changes (#3120) #3398

Merged

This was referenced Jul 17, 2024

Update ghsa-m425-mq94-257g.md #3399

Merged

docs: add known issue #3400

Merged

karl-cardenas-coding mentioned this pull request Jul 17, 2024

[version-4-2] Backport/version 4 2/pr 3120 #3407

Merged

karl-cardenas-coding mentioned this pull request Jul 17, 2024

[version-4-1] backport/4-1/pr-3120 #3408

Merged

karl-cardenas-coding mentioned this pull request Jul 17, 2024

[version-4-0]backport/version 4 0/pr-3120 #3409

Merged

karl-cardenas-coding mentioned this pull request Jul 17, 2024

[version-3-4] Security Bulletin Changes (#3120) #3410

Merged

vault-token-factory-spectrocloud bot mentioned this pull request Jul 23, 2024

docs: VMO refactor #3040

Merged

1 task

vault-token-factory-spectrocloud bot mentioned this pull request Aug 19, 2024

chore: bump @typescript-eslint/eslint-plugin from 7.15.0 to 8.0.0 #3522

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Security Bulletin Changes #3120

Security Bulletin Changes #3120

karl-cardenas-coding commented Jun 18, 2024 •

edited

Loading

netlify bot commented Jun 18, 2024 •

edited

Loading

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

github-actions bot Jul 17, 2024

vault-token-factory-spectrocloud bot commented Jul 17, 2024


		# CVE Details

		We provide the most up-to-date information below.

Security Bulletin Changes #3120

Security Bulletin Changes #3120

Conversation

karl-cardenas-coding commented Jun 18, 2024 • edited Loading

Describe the Change

Changed Pages

Jira Tickets

Backports

netlify bot commented Jun 18, 2024 • edited Loading

✅ Deploy Preview for docs-spectrocloud ready!

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

github-actions bot Jul 17, 2024

Choose a reason for hiding this comment

vault-token-factory-spectrocloud bot commented Jul 17, 2024

💔 Some backports could not be created

Manual backport

Questions ?

karl-cardenas-coding commented Jun 18, 2024 •

edited

Loading

netlify bot commented Jun 18, 2024 •

edited

Loading