Threats Tagged 'cve-2025-22872'

This security update for kubevirt addresses multiple vulnerabilities fixed in version 1.7.0. The issues include logic flaws causing denial of service, improper handling of symlinks leading to arbitrary file read/write, bypass of RBAC controls via TLS certificate validation errors, and potential impersonation of privileged components. These vulnerabilities collectively pose a high risk to confidentiality, integrity, and availability of the affected system. The update also includes other bug fixes and improvements.

This security update for Trivy addresses multiple vulnerabilities across various dependencies including hashicorp/go-getter, golang.org/x/crypto/ssh, golang.org/x/net/html, github.com/golang-jwt/jwt, and others. The fixes cover issues such as argument injection, authorization bypass, denial of service, memory consumption, information leaks, and code execution. The update also includes other non-security related fixes and dependency upgrades. No specific affected versions of Trivy are stated in the provided data.

This security update addresses multiple vulnerabilities in the SUSE elemental-register and elemental-toolkit components by updating to elemental-register 1.8.1 and elemental-toolkit 2.3.2. The updates include bumps to dependencies such as github.com/rancher-sandbox/go-tpm and golang.org/x/crypto, which fix several CVEs including CVE-2025-22872, CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181, and CVE-2025-58190. No specific affected versions are provided. No CVSS score is available, but the severity is assessed as high.

This security update for go-sendxmpp addresses multiple issues including vulnerabilities in the embedded golang.org/x/net library that could lead to performance degradation and excessive memory consumption when parsing specially crafted HTML inputs. The update also includes various feature additions and improvements across multiple versions, enhancing authentication mechanisms, error handling, and protocol support.