Red Hat Security AdvisoryRHSA-2021:2461
Red Hat Advanced Cluster Management 2.2.4 security and bug fix update
Released 2021-06-16 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47
Fixes 3 records
Priority MEDIUM 55
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.15037 · Published 2021-04-01 · Partial fix · 1.1.0 CWE-704
Priority MEDIUM 46
Redis is an open-source, in-memory database that persists on disk.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0479 · Published 2021-02-26 · Partial fix · 5.0.11, 6.0.11 CWE-190
Priority LOW 37
The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02027 · Published 2021-03-12 · Partial fix · 4.2.2 CWE-1333
