low

Dropped active Google Cloud Armor security policy

Published Wed, Sep 29th, 2021
Platforms

Summary

There is a known issue where updating a BackendConfig resource using the v1beta1 API removes an active Google Cloud Armor security policy from its service. If you do not configure Google Cloud Armor on your Ingress resources via the BackendConfig, then this issue does not affect your clusters.

Affected Services

Cloud Armor

Remediation

Dropped Cloud Armor security policies must be manually reattached.

Tracked CVEs

No tracked CVEs

References

Contributed by https://github.com/ramimac
Entry Status
Finalized
Disclosure Date
-
Exploitablity Period
-
Known ITW Exploitation
-
Detection Methods
-
Piercing Index Rating
-
Discovered by
-

More vulnerabilities...

low

Azure AD Seamless SSO logging bypass

Azure Active Directory Seamless Single Sign-On feature allowed single-factor brute-force attacks against Azure AD without generating sign-in events in the targeted organization’s tenant.

...
Secureworks

low

Exfiltrate data via the logs of GCP Org policy

Upon blocking a request, GCP Org policy constraints were logging the deny logs in Principal''s project and the blocking project. An attacker could use those logs to exfiltrate any data, by making r...

...
Jonathan Rault, TrustOnCloud

low

Predictible seed in Anthos Identity Service LDAP module

A vulnerability was discovered in the Anthos Identity Service (AIS) LDAP module of Anthos clusters on VMware versions 1.8 and 1.8.1 where a seed key used in generating keys is predictable. With thi...

View all