Detections
Analytics
Alpine: multiple k3s packages: security update to 1.29.3.1-r0
medium Tenable Cloud Security Plugin ID 427621
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper
out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to
the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-
Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library
internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In
order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown
HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this
issue when the values collected for attribute `http.request.method` were changed to be restricted to a set
of well-known values and other high cardinality attributes were removed. As a workaround to stop being
affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log
certain requests entirely. For convenience and safe usage of this library, it should by default mark with
the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do
not increase cardinality. In case someone wants to stay with the current behavior, library API should
allow to enable it. (CVE-2023-45142)
- The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other
products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the
extension negotiation message), and a client and server may consequently end up with a connection for
which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because
the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and
mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of
ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in [email protected] and
(if CBC is used) the [email protected] MAC algorithms. This also affects Maverick Synergy Java SSH API
before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80,
AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0,
Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15,
SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH
through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang
XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd
through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and
LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3,
Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server
before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the
mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh
crate before 0.40.2 for Rust. (CVE-2023-48795)
See Also
Plugin Details
Severity: Medium
ID: 427621
Version: Revision 1.11
Type: Local
Published: 5/16/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.39
CVSS v2
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.2
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N
CVSS Score Source: CVE-2023-48795
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6
Threat Score: 5.3
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 6/13/2023
Reference Information
CVE: CVE-2023-45142, CVE-2023-48795