Red Hat Security AdvisoryRHSA-2020:3369
Red Hat OpenShift Service Mesh security update
Released 2020-08-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- OpenShift Service Mesh 1.1 ior-1.1.6-1.el8, servicemesh-1.1.6-1.el8, servicemesh-citadel-1.1.6-1.el8 +12
- Red Hat OpenShift Service Mesh 1.1 kiali-v1.12.10.redhat2-1.el7
Fixes 5 records
Priority CRITICAL 88KEV
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.
CVSS 3.1MEDIUM 6.9· Network · No auth · User interaction · EPSS 0.84887 · Published 2020-04-29 · Partial fix · 3.5.0, 4.4.0 CWE-79
Priority MEDIUM 52
golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975 for Go allows a panic during signature verification in the golang.org/x/crypto/ssh package.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.21052 · Published 2020-02-20 · Partial fix · 0.0.0-20200220183623-bac4c82f6975 CWE-347
Priority MEDIUM 41
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.05213 · Published 2020-07-15 · Partial fix · 4.17.19, 4.17.20 CWE-770
Priority LOW 37
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01886 · Published 2020-06-17 · Partial fix · 0.3.3 CWE-835
Priority LOW 30
macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0141 · Published 2020-05-05 · Partial fix · 1.3.7 CWE-601
THREATIST.IORead the docs