Red Hat Security AdvisoryRHSA-2021:1499
Red Hat Advanced Cluster Management 2.2.3 security and bug fix update
Released 2021-05-04 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47
Fixes 5 records
Priority HIGH 67
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument…
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.042 · Published 2021-03-29 · Partial fix · 1.13.0-2, 1.12.1 CWE-94
Priority MEDIUM 55
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.15037 · Published 2021-04-01 · Partial fix · 1.1.0 CWE-704
Priority MEDIUM 40
This affects the package glob-parent before 5.1.2.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04579 · Published 2021-06-03 · Partial fix · 5.1.2 CWE-400
Priority LOW 37
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02027 · Published 2021-03-12 · Partial fix · 4.2.2 CWE-1333
Priority LOW 27
The netmask package before 2.0.1 for Node.js mishandles certain unexpected characters in an IP address string, such as an octal digit of 9.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0151 · Published 2021-03-30 · Partial fix · 2.0.1 CWE-20
THREATIST.IORead the docs