Skip to content

Commit 4f2ce95

Browse files
bitnami-botbitnami-bot
bitnami-bot
and
bitnami-bot
authored
Update 20260824092812 (#2159)
feat: Updated at 20260824092812 Signed-off-by: bitnami-bot <bitnami-bot@vmware.com> Co-authored-by: bitnami-bot <bitnami-bot@vmware.com>
1 parent cfab6a7 commit 4f2ce95

8 files changed

Lines changed: 612 additions & 0 deletions

‎data/argo-cd/BIT-argo-cd-2025-55191.json‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
{
2+
"schema_version": "1.6.2",
3+
"id": "BIT-argo-cd-2025-55191",
4+
"summary": "Repository Credentials Race Condition Crashes Argo CD Server",
5+
"details": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, 3.2.0, 3.1.0 through 3.1.7, and 3.0.0 through 3.0.18 contain a race condition in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. The vulnerability is located in numerous repository related handlers in the util/db/repository_secrets.go file. A valid API token with repositories resource permissions (create, update, or delete actions) is required to trigger the race condition. This vulnerability causes the entire Argo CD server to crash and become unavailable. Attackers can repeatedly and continuously trigger the race condition to maintain a denial-of-service state, disrupting all GitOps operations. This issue is fixed in versions 2.14.20, 3.1.8 and 3.0.19.",
6+
"aliases": [
7+
"CVE-2025-55191"
8+
],
9+
"affected": [
10+
{
11+
"package": {
12+
"ecosystem": "Bitnami",
13+
"name": "argo-cd",
14+
"purl": "pkg:bitnami/argo-cd"
15+
},
16+
"severity": [
17+
{
18+
"type": "CVSS_V3",
19+
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"
20+
}
21+
],
22+
"ranges": [
23+
{
24+
"type": "SEMVER",
25+
"events": [
26+
{
27+
"introduced": "2.1.0"
28+
},
29+
{
30+
"fixed": "2.14.20"
31+
},
32+
{
33+
"introduced": "3.0.0"
34+
},
35+
{
36+
"fixed": "3.0.19"
37+
},
38+
{
39+
"introduced": "3.1.0"
40+
},
41+
{
42+
"fixed": "3.1.8"
43+
}
44+
]
45+
}
46+
]
47+
}
48+
],
49+
"database_specific": {
50+
"severity": "Medium",
51+
"cpes": [
52+
"cpe:2.3:a:linuxfoundation:argo_continuous_delivery:*:*:*:*:*:kubernetes:*:*"
53+
]
54+
},
55+
"references": [
56+
{
57+
"type": "WEB",
58+
"url": "https://github.com/argoproj/argo-cd/commit/701bc50d01c752cad96185f848088d287a97c7b7"
59+
},
60+
{
61+
"type": "WEB",
62+
"url": "https://github.com/argoproj/argo-cd/pull/6103"
63+
},
64+
{
65+
"type": "WEB",
66+
"url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-g88p-r42r-ppp9"
67+
},
68+
{
69+
"type": "WEB",
70+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55191"
71+
}
72+
],
73+
"published": "2026-08-24T09:32:22.564Z",
74+
"modified": "2026-08-24T10:01:09.721Z"
75+
}

‎data/cosign/BIT-cosign-2026-22703.json‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
{
2+
"schema_version": "1.6.2",
3+
"id": "BIT-cosign-2026-22703",
4+
"summary": "Cosign verification accepts any valid Rekor entry under certain conditions",
5+
"details": "Cosign provides code signing and transparency for containers and binaries. Prior to versions 2.6.2 and 3.0.4, Cosign bundle can be crafted to successfully verify an artifact even if the embedded Rekor entry does not reference the artifact's digest, signature or public key. When verifying a Rekor entry, Cosign verifies the Rekor entry signature, and also compares the artifact's digest, the user's public key from either a Fulcio certificate or provided by the user, and the artifact signature to the Rekor entry contents. Without these comparisons, Cosign would accept any response from Rekor as valid. A malicious actor that has compromised a user's identity or signing key could construct a valid Cosign bundle by including any arbitrary Rekor entry, thus preventing the user from being able to audit the signing event. This issue has been patched in versions 2.6.2 and 3.0.4.",
6+
"aliases": [
7+
"CVE-2026-22703"
8+
],
9+
"affected": [
10+
{
11+
"package": {
12+
"ecosystem": "Bitnami",
13+
"name": "cosign",
14+
"purl": "pkg:bitnami/cosign"
15+
},
16+
"severity": [
17+
{
18+
"type": "CVSS_V3",
19+
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
20+
}
21+
],
22+
"ranges": [
23+
{
24+
"type": "SEMVER",
25+
"events": [
26+
{
27+
"introduced": "2.0.0"
28+
},
29+
{
30+
"fixed": "2.6.2"
31+
},
32+
{
33+
"introduced": "3.0.0"
34+
},
35+
{
36+
"fixed": "3.0.4"
37+
}
38+
]
39+
}
40+
]
41+
}
42+
],
43+
"database_specific": {
44+
"severity": "Medium",
45+
"cpes": [
46+
"cpe:2.3:a:sigstore:cosign:*:*:*:*:*:go:*:*"
47+
]
48+
},
49+
"references": [
50+
{
51+
"type": "WEB",
52+
"url": "https://github.com/sigstore/cosign/commit/6832fba4928c1ad69400235bbc41212de5006176"
53+
},
54+
{
55+
"type": "WEB",
56+
"url": "https://github.com/sigstore/cosign/pull/4623"
57+
},
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/sigstore/cosign/security/advisories/GHSA-whqx-f9j3-ch6m"
61+
},
62+
{
63+
"type": "WEB",
64+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22703"
65+
}
66+
],
67+
"published": "2026-08-24T09:32:29.312Z",
68+
"modified": "2026-08-24T10:01:09.721Z"
69+
}

‎data/libpython/BIT-libpython-2026-15806.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.6.2",
3+
"id": "BIT-libpython-2026-15806",
4+
"summary": "`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching",
5+
"details": "The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.",
6+
"aliases": [
7+
"CVE-2026-15806"
8+
],
9+
"affected": [
10+
{
11+
"package": {
12+
"ecosystem": "Bitnami",
13+
"name": "libpython",
14+
"purl": "pkg:bitnami/libpython"
15+
},
16+
"severity": [
17+
{
18+
"type": "CVSS_V4",
19+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
20+
}
21+
],
22+
"ranges": [
23+
{
24+
"type": "SEMVER",
25+
"events": [
26+
{
27+
"introduced": "0"
28+
}
29+
]
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"severity": "Medium",
36+
"cpes": [
37+
"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
38+
]
39+
},
40+
"references": [
41+
{
42+
"type": "WEB",
43+
"url": "http://www.openwall.com/lists/oss-security/2026/08/18/3"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce"
64+
},
65+
{
66+
"type": "WEB",
67+
"url": "https://github.com/python/cpython/issues/155694"
68+
},
69+
{
70+
"type": "WEB",
71+
"url": "https://github.com/python/cpython/pull/155696"
72+
},
73+
{
74+
"type": "WEB",
75+
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/"
76+
},
77+
{
78+
"type": "WEB",
79+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15806"
80+
}
81+
],
82+
"published": "2026-08-24T09:36:56.153Z",
83+
"modified": "2026-08-24T10:01:09.721Z"
84+
}

‎data/libpython/BIT-libpython-2026-17084.json‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
{
2+
"schema_version": "1.6.2",
3+
"id": "BIT-libpython-2026-17084",
4+
"summary": "stringprep.map_table_b2() deviates from RFC 3454 Table B.2",
5+
"details": "The \"stringprep\" module didn't process characters from RFC 3454 tables \nB.2 or B.3 correctly: the latest Unicode codepoint attributes were used \ninstead of the specified Unicode 3.2.0. This behavior would cause \nmismatches when processing domain names using IDNA 2003 (the \"idna\" \ncodec) and the in_table_b2() function of the \"stringprep\" module. This \nonly affects domain names containing characters that were not previously\n registered or had their Unicode attributes such as case-folding \nbehavior updated since Unicode 3.2.0.",
6+
"aliases": [
7+
"CVE-2026-17084"
8+
],
9+
"affected": [
10+
{
11+
"package": {
12+
"ecosystem": "Bitnami",
13+
"name": "libpython",
14+
"purl": "pkg:bitnami/libpython"
15+
},
16+
"severity": [
17+
{
18+
"type": "CVSS_V4",
19+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
20+
}
21+
],
22+
"ranges": [
23+
{
24+
"type": "SEMVER",
25+
"events": [
26+
{
27+
"introduced": "0"
28+
}
29+
]
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"severity": "Medium",
36+
"cpes": [
37+
"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
38+
]
39+
},
40+
"references": [
41+
{
42+
"type": "WEB",
43+
"url": "http://www.openwall.com/lists/oss-security/2026/08/18/2"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/python/cpython/commit/5181304bcec9cfc3c15311741c9154cdff2e3fd7"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/python/cpython/commit/7e109d084d55e7eb25837a5f3b47ef9beee547bc"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://github.com/python/cpython/issues/155292"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://github.com/python/cpython/pull/155293"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/EUHHTC6EV7HCLSUHP25C5VHSV4V2MUZN/"
64+
},
65+
{
66+
"type": "WEB",
67+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17084"
68+
}
69+
],
70+
"published": "2026-08-24T09:36:57.332Z",
71+
"modified": "2026-08-24T10:01:09.721Z"
72+
}

‎data/python-min/BIT-python-min-2026-15806.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.6.2",
3+
"id": "BIT-python-min-2026-15806",
4+
"summary": "`HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching",
5+
"details": "The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://.\n\nCredential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication.\n\nUsers who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs.",
6+
"aliases": [
7+
"CVE-2026-15806"
8+
],
9+
"affected": [
10+
{
11+
"package": {
12+
"ecosystem": "Bitnami",
13+
"name": "python-min",
14+
"purl": "pkg:bitnami/python-min"
15+
},
16+
"severity": [
17+
{
18+
"type": "CVSS_V4",
19+
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
20+
}
21+
],
22+
"ranges": [
23+
{
24+
"type": "SEMVER",
25+
"events": [
26+
{
27+
"introduced": "0"
28+
}
29+
]
30+
}
31+
]
32+
}
33+
],
34+
"database_specific": {
35+
"severity": "Medium",
36+
"cpes": [
37+
"cpe:2.3:a:python:python:*:*:*:*:*:*:*:*"
38+
]
39+
},
40+
"references": [
41+
{
42+
"type": "WEB",
43+
"url": "http://www.openwall.com/lists/oss-security/2026/08/18/3"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://github.com/python/cpython/commit/641be42bb07921ba0f8bffe228b1dc706b092ef6"
48+
},
49+
{
50+
"type": "WEB",
51+
"url": "https://github.com/python/cpython/commit/851cf9a7142ecbdd39f831055533f58284ad2bcc"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://github.com/python/cpython/commit/a0d023fbd23773e24b35d8368789470e22cda5d8"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://github.com/python/cpython/commit/a2773a34183b7d94a243bb98fd658926cc5348ce"
60+
},
61+
{
62+
"type": "WEB",
63+
"url": "https://github.com/python/cpython/commit/a7bb524fef61f77ede01f660ffbd591e1d5837ce"
64+
},
65+
{
66+
"type": "WEB",
67+
"url": "https://github.com/python/cpython/issues/155694"
68+
},
69+
{
70+
"type": "WEB",
71+
"url": "https://github.com/python/cpython/pull/155696"
72+
},
73+
{
74+
"type": "WEB",
75+
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/3OKPE5S75KDNA7FY7AI3PL2MXM2X5RB3/"
76+
},
77+
{
78+
"type": "WEB",
79+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15806"
80+
}
81+
],
82+
"published": "2026-08-24T09:42:09.665Z",
83+
"modified": "2026-08-24T10:01:09.721Z"
84+
}

0 commit comments

Comments
 (0)