Allele Security Intelligence

ASA-2019-00493 – Kubernetes: Incomplete fixes for CVE-2019-1002101 and CVE-2019-11246, kubectl cp potential directory traversal

Posted on August 9, 2019August 29, 2019 by Allele Security Intelligence in Alerts

This vulnerability allows a malicious container to cause a file to be created or replaced on the client computer when the client uses the kubectl cp operation. The vulnerability is a client-side defect and requires user interaction to be exploited.

ASA-2019-00473 – Mikrotik RouterOS: Memory exhaustion via a crafted POST request

Posted on July 26, 2019November 30, 2020 by Allele Security Intelligence in Alerts

This vulnerability is similar to the CVE-2018-1157. An authenticated user can cause the www binary to consume all memory via a crafted POST request to /jsproxy/upload. It's because of the incomplete fix for the CVE-2018-1157.