9-15-24 palette cve updates #3930

frederickjoi · 2024-09-16T16:22:59Z

Describe the Change

Loaded palette cves 9-15-24

This PR ....

Changed Pages

💻 Add Preview URL for Page

Jira Tickets

🎫 Jira Ticket

Backports

Can this PR be backported?

Yes. Remember to add the relevant backport labels to your PR.
No. Please leave a short comment below about why this PR cannot be backported.

netlify · 2024-09-16T16:23:16Z

✅ Deploy Preview for docs-spectrocloud ready!

Name	Link
🔨 Latest commit	`43cb95e`
🔍 Latest deploy log	https://app.netlify.com/sites/docs-spectrocloud/deploys/66e98ed3fac0a7000894384c
😎 Deploy Preview	https://deploy-preview-3930--docs-spectrocloud.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

vale

github-actions · 2024-09-16T16:23:57Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

+
+## Last Update
+
+09/15/2024


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T16:23:57Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

+
+## NIST CVE Summary
+
+A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.


🚫 [vale] _{reported by reviewdog 🐶}
[spectrocloud-docs-internal.acronym] Use title case to define the acronym '(SEGV)'.

github-actions · 2024-09-16T16:23:57Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

+
+## NIST CVE Summary
+
+A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'libtiff'?

github-actions · 2024-09-16T16:23:58Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

+
+## Revision History
+
+- 1.0 09/15/2024 Initial Publication


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T16:23:58Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

+## Revision History
+
+- 1.0 09/15/2024 Initial Publication
+- 2.0 09/15/2024 Added palette VerteX 4.4.18 to Affected Products


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T16:23:59Z

docs/docs-content/security-bulletins/reports/cve-2022-41725.md

+
+## NIST CVE Summary
+
+A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'reenabled'?

github-actions · 2024-09-16T16:23:59Z

docs/docs-content/security-bulletins/reports/cve-2022-41725.md

+
+## NIST CVE Summary
+
+A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'HTTP' instead of 'http'.

github-actions · 2024-09-16T16:23:59Z

docs/docs-content/security-bulletins/reports/cve-2022-41725.md

+
+## NIST CVE Summary
+
+A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'HTTP' instead of 'http'.

github-actions · 2024-09-16T16:23:59Z

docs/docs-content/security-bulletins/reports/cve-2022-41725.md

+
+## Revision History
+
+- 1.0 09/15/2024 Initial Publication


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

docs/docs-content/security-bulletins/reports/cve-2022-41725.md

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

vale

github-actions · 2024-09-16T16:26:39Z

docs/docs-content/security-bulletins/reports/cve-2022-28948.md

+
+## NIST CVE Summary
+
+An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'Unmarshal'?

github-actions · 2024-09-16T16:26:39Z

docs/docs-content/security-bulletins/reports/cve-2022-28948.md

+
+## NIST CVE Summary
+
+An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'deserialize'?

github-actions · 2024-09-16T16:26:39Z

docs/docs-content/security-bulletins/reports/cve-2022-28948.md

+## Revision History
+
+- 1.0 09/15/2024 Initial Publication
+- 2.0 09/15/2024 Added palette VerteX 4.4.18 to Affected Products


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T16:26:39Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

+
+## NIST CVE Summary
+
+A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the


🚫 [vale] _{reported by reviewdog 🐶}
[spectrocloud-docs-internal.acronym] Use title case to define the acronym '(SEGV)'.

github-actions · 2024-09-16T16:26:39Z

docs/docs-content/security-bulletins/reports/cve-2023-52356.md

+
+## NIST CVE Summary
+
+A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'libtiff'?

github-actions · 2024-09-16T16:26:40Z

docs/docs-content/security-bulletins/reports/cve-2024-3651.md

@@ -26,7 +26,11 @@ the processing time in a quadratic manner relative to the input size.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+The idna package is a Python library that provides support for Internationalized Domain Names in Applications (IDNA). It


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'idna'?

github-actions · 2024-09-16T16:26:40Z

docs/docs-content/security-bulletins/reports/cve-2024-3651.md

@@ -26,7 +26,11 @@ the processing time in a quadratic manner relative to the input size.

 ## Our Official Summary

-Investigation is ongoing to determine how this vulnerability affects our products.
+The idna package is a Python library that provides support for Internationalized Domain Names in Applications (IDNA). It


🚫 [vale] _{reported by reviewdog 🐶}
[spectrocloud-docs-internal.acronym] Use title case to define the acronym '(IDNA)'.

github-actions · 2024-09-16T16:26:40Z

docs/docs-content/security-bulletins/reports/cve-2024-3651.md

-Investigation is ongoing to determine how this vulnerability affects our products.
+The idna package is a Python library that provides support for Internationalized Domain Names in Applications (IDNA). It
+allows encoding and decoding of domain names containing non-ASCII characters. This vulnerability affects versions prior
+to 3.7 of the idna package. Domain names cannot exceed 253 characters in length, so enforcing this limit can prevent the


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'idna'?

github-actions · 2024-09-16T16:26:41Z

docs/docs-content/security-bulletins/reports/cve-2022-41724.md

+
+## Last Update
+
+09/15/2024


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T16:26:41Z

docs/docs-content/security-bulletins/reports/cve-2022-41724.md

+
+Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records
+which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3
+clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'config' instead of 'Config'.

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

vale

github-actions · 2024-09-16T17:03:18Z

docs/docs-content/security-bulletins/reports/cve-2022-41724.md

+Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records
+which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3
+clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil
+value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'config' instead of 'Config'.

github-actions · 2024-09-16T17:03:18Z

docs/docs-content/security-bulletins/reports/cve-2022-41724.md

+
+## Revision History
+
+- 1.0 09/15/2024 Initial Publication


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T17:03:18Z

docs/docs-content/security-bulletins/reports/cve-2022-41724.md

+## Revision History
+
+- 1.0 09/15/2024 Initial Publication
+- 2.0 09/15/2024 Added palette VerteX 4.4.18 to Affected Products


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T17:03:18Z

docs/docs-content/security-bulletins/reports/cve-2023-45287.md

+
+## Last Update
+
+09/15/2024


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T17:03:19Z

docs/docs-content/security-bulletins/reports/cve-2023-45287.md

+
+## Revision History
+
+- 1.0 09/15/2024 Initial Publication


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T17:03:20Z

docs/docs-content/security-bulletins/reports/cve-2023-29400.md

+enable an attacker to inject arbitrary attributes into HTML tags, potentially leading to cross-site scripting (XSS)
+attacks or other security vulnerabilities. All the images in which this CVE is reported are 3rd party images, which do
+not process HTML data. So possibility of this vulnerability getting exploited in Spectro Cloud products is low. Waiting
+on upsteam fixes.


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'upsteam'?

github-actions · 2024-09-16T17:03:20Z

docs/docs-content/security-bulletins/reports/cve-2023-29400.md

+
+## Revision History
+
+- 1.0 09/15/2024 Initial Publication


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T17:03:20Z

docs/docs-content/security-bulletins/reports/cve-2023-29400.md

+## Revision History
+
+- 1.0 09/15/2024 Initial Publication
+- 2.0 09/15/2024 Added palette VerteX 4.4.18 to Affected Products


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T17:03:20Z

docs/docs-content/security-bulletins/reports/cve-2023-29403.md

+
+## Last Update
+
+09/15/2024


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-16T17:03:20Z

docs/docs-content/security-bulletins/reports/cve-2023-29403.md

+
+## NIST CVE Summary
+
+On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can


🚫 [vale] _{reported by reviewdog 🐶}
[spectrocloud-docs-internal.ableism] Avoid using ableism terms. Use 'issue' instead of 'run'.

github-actions

Remaining comments which cannot be posted as a review comment to avoid GitHub Rate Limit

vale

docs/docs-content/security-bulletins/reports/cve-2023-29403.md

docs/docs-content/security-bulletins/reports/cve-2022-28357.md

docs/docs-content/security-bulletins/reports/cve-2023-24534.md

docs/docs-content/security-bulletins/reports/cve-2023-24538.md

github-actions · 2024-09-17T14:16:00Z

docs/docs-content/security-bulletins/reports/cve-2023-24540.md

+improper handling of JavaScript whitespace characters in certain contexts, leading to potential security risks. Systems
+using Golang Go versions up to 1.19.9 and from 1.20.0 to 1.20.4 are affected, particularly those using the html/template
+package with JavaScript contexts containing actions and specific whitespace characters. The images in which
+vulnerabilities are report do not use the html package. So possibility of this vulnerability getting exploited in


🚫 [vale] _{reported by reviewdog 🐶}
[write-good.So] Don't start a sentence with 'So '.

github-actions · 2024-09-17T14:16:00Z

docs/docs-content/security-bulletins/reports/cve-2024-21626.md

@@ -18,7 +18,7 @@ tags: ["security", "cve"]

 ## NIST CVE Summary

-runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and
+runc is a CLI tool for spawning and using containers on Linux according to the OCI specification. In runc 1.1.11 and


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'runc'?

github-actions · 2024-09-17T14:16:00Z

docs/docs-content/security-bulletins/reports/cve-2024-21626.md

@@ -18,7 +18,7 @@ tags: ["security", "cve"]

 ## NIST CVE Summary

-runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and
+runc is a CLI tool for spawning and using containers on Linux according to the OCI specification. In runc 1.1.11 and


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'runc'?

github-actions · 2024-09-17T14:16:00Z

docs/docs-content/security-bulletins/reports/cve-2023-24538.md

+interpolation, the decision was made to simply disallow Go template actions from being used inside of them
+e.g.`"var a = {{.}}"`, since there is no safe way to allow this behavior. This takes the same approach as
+github.com/google/safehtml. With fix, Template.Parse returns an Error when it encounters templates like this, with an
+ErrorCode of value 12. This ErrorCode is currently unexported, but will be exported in the release of Go 1.21. Users who


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'unexported'?

github-actions · 2024-09-17T14:16:00Z

docs/docs-content/security-bulletins/reports/cve-2023-24538.md

+
+## Revision History
+
+- 1.0 09/15/2024 Initial Publication


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-17T14:16:01Z

docs/docs-content/security-bulletins/reports/cve-2023-24536.md

+
+## Last Update
+
+09/15/2024


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-17T14:16:01Z

docs/docs-content/security-bulletins/reports/cve-2023-24536.md

+
+Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large
+numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed
+multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Spelling] Did you really mean 'undercount'?

github-actions · 2024-09-17T14:16:01Z

docs/docs-content/security-bulletins/reports/cve-2023-24536.md

+numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers,
+further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause
+an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of
+service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package


🚫 [vale] _{reported by reviewdog 🐶}
[Vale.Terms] Use 'HTTP' instead of 'http'.

github-actions · 2024-09-17T14:16:01Z

docs/docs-content/security-bulletins/reports/cve-2023-24536.md

+
+## Revision History
+
+- 1.0 09/15/2024 Initial Publication


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

github-actions · 2024-09-17T14:16:01Z

docs/docs-content/security-bulletins/reports/cve-2023-24536.md

+## Revision History
+
+- 1.0 09/15/2024 Initial Publication
+- 2.0 09/15/2024 Added palette VerteX 4.4.18 to Affected Products


🚫 [vale] _{reported by reviewdog 🐶}
[Google.DateFormat] Use 'July 31, 2016' format, not '09/15/2024'.

* 9-15-24 palette cve updates * ci: auto-formatting prettier issues * chore: fixed symbol issues * chore: fix redirect * chore: vale fixes --------- Co-authored-by: frederickjoi <[email protected]> Co-authored-by: Karl Cardenas <[email protected]> (cherry picked from commit 8fe8d40)

vault-token-factory-spectrocloud · 2024-09-17T14:39:07Z

💚 All backports created successfully

Status	Branch	Result
✅	version-4-4

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details

* 9-15-24 palette cve updates * ci: auto-formatting prettier issues * chore: fixed symbol issues * chore: fix redirect * chore: vale fixes --------- Co-authored-by: frederickjoi <[email protected]> Co-authored-by: Karl Cardenas <[email protected]> (cherry picked from commit 8fe8d40) Co-authored-by: frederickjoi <[email protected]>

vault-token-factory-spectrocloud · 2024-10-13T16:10:48Z

🎉 This issue has been resolved in version 4.5.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

9-15-24 palette cve updates

5408062

frederickjoi requested a review from a team as a code owner September 16, 2024 16:23

frederickjoi requested review from karl-cardenas-coding, addetz and lennessyy September 16, 2024 16:23

github-actions bot reviewed Sep 16, 2024

View reviewed changes

ci: auto-formatting prettier issues

57d369c

github-actions bot reviewed Sep 16, 2024

View reviewed changes

chore: fixed symbol issues

7e98793

karl-cardenas-coding approved these changes Sep 16, 2024

View reviewed changes

github-actions bot reviewed Sep 16, 2024

View reviewed changes

karl-cardenas-coding added auto-backport Enable backport backport-version-4-4 Backport change to version 4.4 labels Sep 16, 2024

karl-cardenas-coding added 2 commits September 17, 2024 07:04

chore: fix redirect

488db23

Merge branch 'master' into 9-15-24-palette-cve-update

abf61df

github-actions bot reviewed Sep 17, 2024

View reviewed changes

chore: vale fixes

43cb95e

github-actions bot reviewed Sep 17, 2024

View reviewed changes

karl-cardenas-coding merged commit 8fe8d40 into master Sep 17, 2024
15 checks passed

karl-cardenas-coding deleted the 9-15-24-palette-cve-update branch September 17, 2024 14:37

vault-token-factory-spectrocloud bot mentioned this pull request Sep 17, 2024

[version-4-4] docs: 9-15-24 palette cve updates (#3930) #3943

Merged

vault-token-factory-spectrocloud bot added the released label Oct 13, 2024


		## NIST CVE Summary

		A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.


		## NIST CVE Summary

		A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing "up to maxMemory bytes +10MB (reserved for non-file parts) in memory". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, "If stored on disk, the File's underlying concrete type will be an *os.File.". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.


		## NIST CVE Summary

		An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid


		## NIST CVE Summary

		On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can

9-15-24 palette cve updates #3930

9-15-24 palette cve updates #3930

Conversation

frederickjoi commented Sep 16, 2024

Describe the Change

Changed Pages

Jira Tickets

Backports

netlify bot commented Sep 16, 2024 • edited Loading

✅ Deploy Preview for docs-spectrocloud ready!

github-actions bot left a comment

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot left a comment

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot left a comment

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot Sep 16, 2024

Choose a reason for hiding this comment

github-actions bot left a comment

Choose a reason for hiding this comment

github-actions bot Sep 17, 2024

Choose a reason for hiding this comment

github-actions bot Sep 17, 2024

Choose a reason for hiding this comment

netlify bot commented Sep 16, 2024 •

edited

Loading