Cncf

8 CVEs across 4 Cncf products. Browse Cncf vulnerabilities, severities, and proof-of-concept exploits.

Cncf products with known CVEs

ProductCVEs
Envoy3
Crossplane2
Spire2
Portmap1
Cncf CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2023-38495High8.32023-07-27Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's…
CVE-2023-37900Low3.42023-07-27Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, a high-privi…
CVE-2021-27099Medium6.82021-03-05In SPIRE before versions 0.8.5, 0.9.4, 0.10.2, 0.11.3 and 0.12.1, the "aws_iid" Node Attestor improperly normalizes the path provided through the agent ID temp…
CVE-2021-27098High8.12021-03-05In SPIRE 0.8.1 through 0.8.4 and before versions 0.9.4, 0.10.2, 0.11.3 and 0.12.1, specially crafted requests to the FetchX509SVID RPC of SPIRE Server’s Legacy…
CVE-2020-8664Medium5.32020-03-04CNCF Envoy through 1.13.0 has incorrect Access Control when using SDS with Combined Validation Context. Using the same secret (e.g. trusted CA) across many res…
CVE-2020-8661High7.52020-03-04CNCF Envoy through 1.13.0 may consume excessive amounts of memory when responding internally to pipelined requests.
CVE-2020-8659High7.52020-03-04CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks.
CVE-2019-9946High7.52019-04-02Cloud Native Computing Foundation (CNCF) CNI (Container Networking Interface) 0.7.4 has a network firewall misconfiguration which affects Kubernetes. The CNI '…