You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code (MAC), which then allows an attacker who has write access to the target's S3 bucket and can observe whether or not an endpoint with access to the key can decrypt a file, they can reconstruct the plaintext with (on average) 128*length (plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors. It is recommended to update your SDK to V2 or later, and re-encrypt your files.
Affected range
>=0
Fixed version
Not Fixed
Description
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this in combination with a decryption oracle can reveal the authentication key used by AES-GCM as decrypting the GMAC tag leaves the authentication key recoverable as an algebraic equation. It is recommended to update your SDK to V2 or later, and re-encrypt your files.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected range
>=3.0.0 <=3.5.1
Fixed version
Not Fixed
CVSS Score
6.1
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Description
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.124.4->1.124.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
replicatedhq/kots (replicatedhq/kots)
v1.124.5Compare Source
Changelog
990b897Move existing-airgap-install regression tests to playwright (#5191)d265ce5ensure that page is loaded before filling boxes (#5172)3a71009Fix checking version history rows for regression tests (#5189)17c32c6Fix 3rd row index in regression tests (#5188)4cd2db9Fix validating deploy logs for regression tests (#5187)62ef362Fix expected restore sequence for regression tests (#5186)2217906Fix validating release notes in regression tests (#5185)804be0bchore(ci): move smoke-test-airgap test to playwright (#5175)f98205bAdd snapshots RBAC before validating dashboard (#5182)c7c28efFix sequences in regression tests (#5181)b51f7a6Updating regression tests config can take more than 5 seconds (#5179)39d642fchore(ci): move support-bundle test to playwright (#5168)c727b83Move checking for updates earlier in the regression test (#5176)300dbcaFix flakiness in playwright regression tests (#5174)28e7e90Updating cosign in GHA - co-committed with st0mrz1 (#5170)211ceb2Move existing-online-install-minimal regression test to playwright (#5173)5527492Move existing-online-install-admin regression test to playwright (#5171)8bafe79move version history pagination test to playwright (#5169)d0a73a0Update README.md (#5157)d60aabbchore(ci): move range-kots-version test to playwright (#5167)e8991dcmigrate validate-gitops from testim to playwright (#5165)49dd4cbchore(ci): move target-kots-version test to playwright (#5166)f631e08Move min-kots-version test to Playwright (#5164)307cdb7chore: update go version to 1.24 (#5163)1b091e9chore(deps): bump @mui/icons-material from 5.16.7 to 5.16.14 in /web (#5154)974d31fchore(deps): bump github.com/coreos/go-oidc (#5160)1df9f76chore(deps): bump the security group in /web with 9 updates (#5158)e3fd164chore(deps): bump github.com/go-jose/go-jose/v4 in the go_modules group (#5155)865067fchore(deps): bump the security group in /web with 8 updates (#5153)debec55chore(deps): bump github.com/gosimple/slug from 1.14.0 to 1.15.0 (#5152)c15199achore(deps): bump golang.org/x/crypto from 0.32.0 to 0.34.0 (#5151)19486a5update go to 1.24+ (#5150)21efc0cUpdate KOTS image dependency tags (#5149)1251442chore(deps): bump github.com/containers/image/v5 from 5.33.1 to 5.34.0 (#5132)a88b2aechore(deps): bump elliptic in /web in the npm_and_yarn group (#5148)debc582chore(deps): bump the security group in /web with 10 updates (#5144)2e07f69chore(deps): bump the security group with 8 updates (#5147)a2234c3chore(deps): bump the security group in /kurl_proxy with 3 updates (#5146)72fa47echore(deps): bump apexcharts from 3.54.1 to 4.4.0 in /web (#5145)Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.