Red Hat Security AdvisoryRHSA-2021:3851
Red Hat 3scale API Management 2.11.0 Release - Container Images
Released 2021-10-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat 3Scale AMP 2.11 3scale-amp2/3scale-rhel7-operator, 3scale-amp2/3scale-rhel7-operator-metadata, 3scale-amp2/apicast-gateway-rhel8 +7
Fixes 5 records
Priority HIGH 66
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other…
CVSS 3.1HIGH 7.7· Network · No auth · No interaction · EPSS 0.53461 · Published 2021-06-01 · Partial fix CWE-193
Priority LOW 35
It was found that 3scale's APIdocs does not validate the access token, in the case of invalid token, it uses session auth instead.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01158 · Published 2022-03-25 · Fixed CWE-862
Priority LOW 25
A flaw was found in the Red Hat OpenShift API Management product.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00501 · Published 2022-08-22 · Fixed CWE-20
Priority LOW 25
A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2.
CVSS 3.1MEDIUM 5.6· Local · Low privileges · No interaction · EPSS 0.00346 · Published 2020-08-11 · Partial fix · 1.34.0 CWE-327
Priority LOW 12
A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2.
CVSS 3.1LOW 2.5· Local · Low privileges · No interaction · EPSS 0.00231 · Published 2020-08-11 · Partial fix · 1.34.0 CWE-327
THREATIST.IORead the docs