Red Hat Security AdvisoryRHSA-2021:1168
Red Hat Advanced Cluster Management 2.2.2 security and bug fix update
Released 2021-04-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47
Fixes 10 records
Priority HIGH 70
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.50732 · Published 2021-02-16 · Partial fix · 111.14.0 CWE-190
Priority MEDIUM 59
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.21333 · Published 2021-02-15 · Partial fix · 4.17.21 CWE-94
Priority MEDIUM 46
fastify-http-proxy is an npm package which is a fastify plugin for proxying your http requests to another server, with hooks.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01627 · Published 2021-03-02 · Partial fix · 4.3.1 CWE-20
Priority MEDIUM 46
fastify-reply-from is an npm package which is a fastify plugin to forward the current http request to another server.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01821 · Published 2021-03-02 · Partial fix · 4.0.2 CWE-20
Priority MEDIUM 40
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.07336 · Published 2021-02-15 · Partial fix · 4.17.21 CWE-1333
Priority LOW 38
HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02817 · Published 2020-12-03 · Partial fix · 0.5.0 CWE-22
Priority LOW 37
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0741 · Published 2021-02-16 · Partial fix · 111.14.0 CWE-476
Priority LOW 37
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02325 · Published 2021-01-02 · Partial fix CWE-129
Priority LOW 37
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01886 · Published 2020-06-17 · Partial fix · 0.3.3 CWE-835
Priority LOW 36
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01742 · Published 2021-01-02 · Partial fix CWE-129
THREATIST.IORead the docs