Nixpkgs Security Tracker

Untriaged

Permalink CVE-2025-32963

created 2 months ago

Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.

References

https://github.com/minio/operator/releases/tag/v7.1.0 x_refsource_MISC
https://github.com/minio/operator/security/advisories/GHSA-7m6v-q233-q9j9 x_refsource_CONFIRM
https://github.com/minio/operator/security/advisories/GHSA-7m6v-q233-q9j9 x_refsource_CONFIRM
https://github.com/minio/operator/releases/tag/v7.1.0 x_refsource_MISC
https://github.com/minio/operator/security/advisories/GHSA-7m6v-q233-q9j9 x_refsource_CONFIRM
https://github.com/minio/operator/commit/d586294d526bf0d8e6097225114655f68b0adcc5 x_refsource_MISC
https://github.com/minio/operator/releases/tag/v7.1.0 x_refsource_MISC

Affected products

operator

==< 7.1.0

Matching in nixpkgs

pkgs.operator-sdk

SDK for building Kubernetes applications. Provides high level APIs, useful abstractions, and project scaffolding

nixos-unstable 1.39.2
- nixpkgs-unstable 1.39.2
- nixos-unstable-small 1.39.2

pkgs.atomic-operator

Tool to execute Atomic Red Team tests (Atomics)

nixos-unstable 0.8.5
- nixpkgs-unstable 0.8.5
- nixos-unstable-small 0.8.5

pkgs.fluxcd-operator

Kubernetes controller for managing the lifecycle of Flux CD

nixos-unstable 0.23.0
- nixpkgs-unstable 0.23.0
- nixos-unstable-small 0.23.0

pkgs.fluxcd-operator-mcp

Kubernetes controller for managing the lifecycle of Flux CD

nixos-unstable 0.29.0
- nixpkgs-unstable 0.29.0
- nixos-unstable-small 0.29.0

pkgs.python312Packages.linear-operator

LinearOperator implementation to wrap the numerical nuts and bolts of GPyTorch

nixos-unstable 0.6
- nixpkgs-unstable 0.6
- nixos-unstable-small 0.6

pkgs.python313Packages.linear-operator

LinearOperator implementation to wrap the numerical nuts and bolts of GPyTorch

nixos-unstable 0.6
- nixpkgs-unstable 0.6
- nixos-unstable-small 0.6

pkgs.chickenPackages_5.chickenEggs.F-operator

Shift/Reset Control Operators

nixos-unstable 4.1.4
- nixpkgs-unstable 4.1.4
- nixos-unstable-small 4.1.4

pkgs.pkgsRocm.python3Packages.linear-operator

LinearOperator implementation to wrap the numerical nuts and bolts of GPyTorch

nixos-unstable 0.6
- nixpkgs-unstable 0.6
- nixos-unstable-small 0.6

Package maintainers

@fabaff Fabian Affolter <mail@fabian-affolter.ch>
@mattfield Matt Field <matt@mild.systems>
@arnarg Arnar Ingason <arnarg@fastmail.com>
@veprbl Dmitry Kalinkin <veprbl@gmail.com>

Untriaged

Permalink CVE-2024-52426

6.5 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): REQUIRED
Scope (S): CHANGED
Confidentiality impact (C): LOW
Integrity impact (I): LOW
Availability impact (A): LOW

created 6 months ago

WordPress Linear plugin <= 2.7.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Linear Oy Linear linear allows DOM-Based XSS.This issue affects Linear: from n/a through 2.7.11.