Security fixes

This topic lists the security fixes in Tanzu Application Platform v1.10 releases.

In this topic:

• v1.10.1 Security fixes
• v1.10.0 Security fixes
• About Linux Kernel CVEs

v1.10.1 Security fixes

This release has the following security fixes, listed by package.

Package Name	Vulnerabilities Resolved
application-configuration-service.tanzu.vmware.com	Expand to see the list GHSA-2wrp-6fg6-hmc5 CVE-2024-26308 CVE-2024-25710 CVE-2023-39326
base-jammy-stack-lite.buildpacks.tanzu.vmware.com	Expand to see the list CVE-2024-35845 CVE-2024-35844 CVE-2024-35830 CVE-2024-35829 CVE-2024-35828 CVE-2024-35811 CVE-2024-33602 CVE-2024-33601 CVE-2024-33600 CVE-2024-33599 CVE-2024-32465 CVE-2024-32021 CVE-2024-32020 CVE-2024-32004 CVE-2024-32002 CVE-2024-27436 CVE-2024-27432 CVE-2024-27431 CVE-2024-27419 CVE-2024-27417 CVE-2024-27416 CVE-2024-27415 CVE-2024-27414 CVE-2024-27413 CVE-2024-27412 CVE-2024-27410 CVE-2024-27405 CVE-2024-27403 CVE-2024-27390 CVE-2024-27388 CVE-2024-27078 CVE-2024-27077 CVE-2024-27076 CVE-2024-27075 CVE-2024-27074 CVE-2024-27073 CVE-2024-27065 CVE-2024-27054 CVE-2024-27053 CVE-2024-27052 CVE-2024-27051 CVE-2024-27047 CVE-2024-27046 CVE-2024-27045 CVE-2024-27044 CVE-2024-27043 CVE-2024-27039 CVE-2024-27038 CVE-2024-27037 CVE-2024-27034 CVE-2024-27030 CVE-2024-27028 CVE-2024-27024 CVE-2024-26915 CVE-2024-26907 CVE-2024-26906 CVE-2024-26903 CVE-2024-26901 CVE-2024-26898 CVE-2024-26897 CVE-2024-26895 CVE-2024-26894 CVE-2024-26891 CVE-2024-26889 CVE-2024-26885 CVE-2024-26884 CVE-2024-26883 CVE-2024-26882 CVE-2024-26881 CVE-2024-26880 CVE-2024-26879 CVE-2024-26878 CVE-2024-26877 CVE-2024-26875 CVE-2024-26874 CVE-2024-26872 CVE-2024-26870 CVE-2024-26863 CVE-2024-26862 CVE-2024-26861 CVE-2024-26859 CVE-2024-26857 CVE-2024-26856 CVE-2024-26855 CVE-2024-26852 CVE-2024-26851 CVE-2024-26846 CVE-2024-26845 CVE-2024-26843 CVE-2024-26840 CVE-2024-26839 CVE-2024-26838 CVE-2024-26835 CVE-2024-26833 CVE-2024-26820 CVE-2024-26816 CVE-2024-26809 CVE-2024-26805 CVE-2024-26804 CVE-2024-26803 CVE-2024-26802 CVE-2024-26801 CVE-2024-26798 CVE-2024-26795 CVE-2024-26793 CVE-2024-26792 CVE-2024-26791 CVE-2024-26790 CVE-2024-26788 CVE-2024-26787 CVE-2024-26782 CVE-2024-26779 CVE-2024-26778 CVE-2024-26777 CVE-2024-26776 CVE-2024-26774 CVE-2024-26773 CVE-2024-26772 CVE-2024-26771 CVE-2024-26769 CVE-2024-26766 CVE-2024-26764 CVE-2024-26763 CVE-2024-26754 CVE-2024-26752 CVE-2024-26751 CVE-2024-26750 CVE-2024-26749 CVE-2024-26748 CVE-2024-26747 CVE-2024-26744 CVE-2024-26743 CVE-2024-26737 CVE-2024-26736 CVE-2024-26735 CVE-2024-26733 CVE-2024-26688 CVE-2024-26659 CVE-2024-26651 CVE-2024-26622 CVE-2024-26603 CVE-2024-26601 CVE-2024-26585 CVE-2024-26584 CVE-2024-26583 CVE-2024-22099 CVE-2024-21823 CVE-2024-0841 CVE-2023-7042 CVE-2023-6270 CVE-2023-52662 CVE-2023-52656 CVE-2023-52652 CVE-2023-52650 CVE-2023-52645 CVE-2023-52644 CVE-2023-52641 CVE-2023-52640 CVE-2023-52620 CVE-2023-52530 CVE-2023-52497 CVE-2023-52447 CVE-2023-52434 CVE-2023-47233
cnrs.tanzu.vmware.com	Expand to see the list CVE-2024-2961
config-server.spring.tanzu.vmware.com	Expand to see the list GHSA-4v7x-pqxf-cx7m CVE-2024-2961 CVE-2024-24788 CVE-2024-21094 CVE-2024-21068 CVE-2024-21012 CVE-2024-21011 CVE-2023-35116
crossplane.tanzu.vmware.com	Expand to see the list CVE-2024-24788
managed-resource-controller.apps.tanzu.vmware.com	Expand to see the list CVE-2024-2961
source.component.apps.tanzu.vmware.com	Expand to see the list GHSA-4v7x-pqxf-cx7m CVE-2024-34397 CVE-2024-2961 CVE-2024-28835 CVE-2024-28834 CVE-2024-28182 CVE-2024-28085 CVE-2024-26920 CVE-2024-26916 CVE-2024-26910 CVE-2024-26829 CVE-2024-26826 CVE-2024-26825 CVE-2024-26808 CVE-2024-26722 CVE-2024-26720 CVE-2024-26717 CVE-2024-26715 CVE-2024-26712 CVE-2024-26707 CVE-2024-26704 CVE-2024-26702 CVE-2024-26698 CVE-2024-26697 CVE-2024-26696 CVE-2024-26695 CVE-2024-26689 CVE-2024-26685 CVE-2024-26684 CVE-2024-26679 CVE-2024-26676 CVE-2024-26675 CVE-2024-26673 CVE-2024-26671 CVE-2024-26668 CVE-2024-26665 CVE-2024-26664 CVE-2024-26663 CVE-2024-26660 CVE-2024-26645 CVE-2024-26644 CVE-2024-26641 CVE-2024-26640 CVE-2024-26636 CVE-2024-26635 CVE-2024-26633 CVE-2024-26631 CVE-2024-26627 CVE-2024-26625 CVE-2024-26615 CVE-2024-26614 CVE-2024-26610 CVE-2024-26608 CVE-2024-26606 CVE-2024-26602 CVE-2024-26600 CVE-2024-26598 CVE-2024-26597 CVE-2024-26594 CVE-2024-26593 CVE-2024-26592 CVE-2024-26591 CVE-2024-26589 CVE-2024-26586 CVE-2024-26581 CVE-2024-24860 CVE-2024-24787 CVE-2024-24785 CVE-2024-24784 CVE-2024-24783 CVE-2024-2398 CVE-2024-23851 CVE-2024-23850 CVE-2024-23849 CVE-2024-22705 CVE-2024-2201 CVE-2024-1151 CVE-2023-52643 CVE-2023-52642 CVE-2023-52638 CVE-2023-52637 CVE-2023-52635 CVE-2023-52633 CVE-2023-52631 CVE-2023-52627 CVE-2023-52623 CVE-2023-52622 CVE-2023-52619 CVE-2023-52618 CVE-2023-52617 CVE-2023-52616 CVE-2023-52615 CVE-2023-52614 CVE-2023-52612 CVE-2023-52610 CVE-2023-52609 CVE-2023-52608 CVE-2023-52607 CVE-2023-52606 CVE-2023-52604 CVE-2023-52603 CVE-2023-52602 CVE-2023-52601 CVE-2023-52600 CVE-2023-52599 CVE-2023-52598 CVE-2023-52597 CVE-2023-52595 CVE-2023-52594 CVE-2023-52588 CVE-2023-52587 CVE-2023-52498 CVE-2023-52494 CVE-2023-52493 CVE-2023-52492 CVE-2023-52491 CVE-2023-52489 CVE-2023-52486 CVE-2023-52480 CVE-2023-52470 CVE-2023-52469 CVE-2023-52467 CVE-2023-52464 CVE-2023-52463 CVE-2023-52462 CVE-2023-52458 CVE-2023-52457 CVE-2023-52456 CVE-2023-52454 CVE-2023-52451 CVE-2023-52449 CVE-2023-52448 CVE-2023-52445 CVE-2023-52444 CVE-2023-52443 CVE-2023-52442 CVE-2023-52441 CVE-2023-52436 CVE-2023-52435 CVE-2023-52429 CVE-2023-52340 CVE-2023-46838 CVE-2023-45290 CVE-2023-45289 CVE-2023-45288 CVE-2023-3867 CVE-2023-38431 CVE-2023-38430 CVE-2023-38427 CVE-2023-32258 CVE-2023-32254 CVE-2023-24023 CVE-2023-1194
supply-chain.apps.tanzu.vmware.com	Expand to see the list CVE-2024-2961 CVE-2024-24788

v1.10.0 Security fixes

This release has the following security fixes, listed by package.

Package Name	Vulnerabilities Resolved
accelerator.apps.tanzu.vmware.com	Expand to see the list GHSA-4v7x-pqxf-cx7m CVE-2024-21012 CVE-2023-39326
amr-observer.apps.tanzu.vmware.com	Expand to see the list CVE-2023-39326
apiserver.appliveview.tanzu.vmware.com	Expand to see the list CVE-2024-24788
aws.services.tanzu.vmware.com	Expand to see the list GHSA-8r3f-844c-mc37 GHSA-4v7x-pqxf-cx7m CVE-2024-2961
cartographer.conventions.apps.tanzu.vmware.com	Expand to see the list GHSA-4v7x-pqxf-cx7m CVE-2023-39326
cartographer.tanzu.vmware.com	Expand to see the list CVE-2024-2961 CVE-2024-24785 CVE-2024-24784 CVE-2024-24783 CVE-2024-0727 CVE-2023-6237 CVE-2023-6129 CVE-2023-5678 CVE-2023-45290 CVE-2023-45289 CVE-2023-45288 CVE-2023-39326
cert-manager.tanzu.vmware.com	Expand to see the list GHSA-c5q2-7r4c-mv6g GHSA-4v7x-pqxf-cx7m CVE-2023-39326
cnrs.tanzu.vmware.com	Expand to see the list GHSA-jq35-85cj-fj4p GHSA-8r3f-844c-mc37 GHSA-6wrf-mxfj-pf5p GHSA-4v7x-pqxf-cx7m GHSA-33pg-m6jh-5237 CVE-2024-24785 CVE-2024-24784 CVE-2024-24783 CVE-2023-45290 CVE-2023-45289 CVE-2023-39326
connector.appliveview.tanzu.vmware.com	Expand to see the list CVE-2024-2961
contour.tanzu.vmware.com	Expand to see the list GHSA-8r3f-844c-mc37 CVE-2023-6780 CVE-2023-45284 CVE-2023-39326
controller.source.apps.tanzu.vmware.com	Expand to see the list GHSA-4v7x-pqxf-cx7m CVE-2023-39326
crossplane.tanzu.vmware.com	Expand to see the list GHSA-qppj-fm5r-hxr3 GHSA-pwcw-6f5g-gxf8 GHSA-mq39-4gv4-mvpx GHSA-jq35-85cj-fj4p GHSA-hmfx-3pcx-653p GHSA-6xv5-86q9-7xr8 GHSA-6rx9-889q-vv2r GHSA-67fx-wx78-jx33 GHSA-53c4-hhmh-vw5q GHSA-2wrh-6pvc-2jm9 GHSA-2qjp-425j-52j9 GHSA-259w-8hf6-59c2 CVE-2024-2961 CVE-2024-29018
fluxcd-source-controller.tanzu.vmware.com	Expand to see the list GHSA-xw73-rw38-6vjc GHSA-vfp6-jrw2-99g9 GHSA-v554-xwgw-hc3w GHSA-v53g-5gjp-272r GHSA-qppj-fm5r-hxr3 GHSA-mq39-4gv4-mvpx GHSA-jw44-4f3j-q396 GHSA-jq35-85cj-fj4p GHSA-f4p5-x4vc-mh4v GHSA-c5q2-7r4c-mv6g GHSA-95pr-fxf5-86gv GHSA-8r3f-844c-mc37 GHSA-88jx-383q-w4qc GHSA-7ww5-4wqc-m92c GHSA-4v7x-pqxf-cx7m GHSA-45x7-px36-x8w8 GHSA-2c7c-3mj9-8fqh CVE-2024-2961 CVE-2024-29018 CVE-2024-24787 CVE-2024-24785 CVE-2024-24784 CVE-2024-24783 CVE-2023-45290 CVE-2023-45289 CVE-2023-45288 CVE-2023-39326 CVE-2023-39319 CVE-2023-39318 CVE-2023-29409 CVE-2023-29406 CVE-2023-24532 CVE-2022-39272
java-lite.buildpacks.tanzu.vmware.com	Expand to see the list GHSA-mq39-4gv4-mvpx CVE-2024-29018
metadata-store.apps.tanzu.vmware.com	Expand to see the list CVE-2024-28835 CVE-2024-28834 CVE-2024-28085 CVE-2024-24785 CVE-2024-24784 CVE-2024-24783 CVE-2023-45290 CVE-2023-45289 CVE-2023-39326 CVE-2022-3715
nodejs-lite.buildpacks.tanzu.vmware.com	Expand to see the list GHSA-x84c-p2g9-rqv9 CVE-2024-32473 CVE-2024-24785 CVE-2024-24784 CVE-2024-24783 CVE-2023-45290 CVE-2023-45289
ruby-lite.buildpacks.tanzu.vmware.com	Expand to see the list GHSA-x84c-p2g9-rqv9 CVE-2024-32473
service-registry.spring.apps.tanzu.vmware.com	Expand to see the list GHSA-8r3f-844c-mc37 GHSA-2wrp-6fg6-hmc5 CVE-2024-24785 CVE-2024-24784 CVE-2024-24783 CVE-2024-20945 CVE-2024-20921 CVE-2024-20919 CVE-2023-45290 CVE-2023-45289 CVE-2023-39326
services-toolkit.tanzu.vmware.com	Expand to see the list GHSA-8r3f-844c-mc37 GHSA-45x7-px36-x8w8 CVE-2023-39326
spring-cloud-gateway.tanzu.vmware.com	Expand to see the list GHSA-xh6m-7cr7-xx66 GHSA-wjxj-5m7g-mg7q GHSA-gvpg-vgmx-xg6w GHSA-c5vj-wp4v-mmvx GHSA-8h4x-xvjp-vf99 GHSA-5gj6-62g7-vmgf CVE-2023-33264 CVE-2021-25740 CVE-2020-8554 CVE-2015-7561
sso.apps.tanzu.vmware.com	Expand to see the list GHSA-xfrj-6vvc-3xm2 CVE-2023-39326
tap-gui.tanzu.vmware.com	Expand to see the list CVE-2024-32487 CVE-2024-2961 CVE-2024-28182 CVE-2024-26581 CVE-2023-52603 CVE-2023-52600 CVE-2023-24023
trivy.app-scanning.component.apps.tanzu.vmware.com	Expand to see the list CVE-2024-28835 CVE-2024-28834 CVE-2024-28085
web-servers-lite.buildpacks.tanzu.vmware.com	Expand to see the list GHSA-x84c-p2g9-rqv9 CVE-2024-32473

About Linux Kernel CVEs

Kernel level vulnerabilities are regularly identified and patched by Canonical. Tanzu Application Platform releases with available images, which might contain known vulnerabilities. When Canonical makes patched images available, Tanzu Application Platform incorporates these fixed images into future releases.

The kernel runs on your container host VM, not the Tanzu Application Platform container image. Even with a patched Tanzu Application Platform image, the vulnerability is not mitigated until you deploy your containers on a host with a patched OS. An unpatched host OS might be exploitable if the base image is deployed.