Red Hat Security Advisory

RHSA-2021:3873

Red Hat Advanced Cluster Management 2.2.9 security, bug, and container updates

Released 2021-10-14 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/search-aggregator-rhel7 +1
Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47

Fixes 11 records

TI-2021-05876 CVE-2021-23017 · GHSA-83p9-mcpm-374v

A security issue in nginx resolver was identified, which might allow an attacker who is…

HIGH 66

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other…

CVSS 3.1HIGH 7.7 Network No auth No interaction EPSS 0.53461 Published 2021-06-01 Partial fix CWE-193

TI-2021-12295 CVE-2021-32626

Lua scripts can overflow the heap-based Lua stack in Redis

MEDIUM 55

Redis is an open source, in-memory database that persists on disk.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.16206 Published 2021-10-04 Partial fix · 6.2.6, 6.0.16 +1 CWE-122

TI-2021-12343 CVE-2021-32675

DoS vulnerability in Redis

MEDIUM 49

Redis is an open source, in-memory database that persists on disk.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.16066 Published 2021-10-04 Partial fix · 5.0.14, 6.0.16 +1 CWE-770

TI-2021-12297 CVE-2021-32628

Vulnerability in handling large ziplists

MEDIUM 48

Redis is an open source, in-memory database that persists on disk.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.1353 Published 2021-10-04 Partial fix · 6.2.6, 6.0.16 +1 CWE-190

TI-2021-06132 CVE-2021-23440 · GHSA-4jqc-8m5r-9rpr

Prototype pollution in set-value

MEDIUM 46

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02206 Published 2021-09-12 Partial fix · 2.0.1, 4.0.1 +2 CWE-843

TI-2021-06126 CVE-2021-23434 · GHSA-v39p-96qg-c8rf

Prototype pollution in object-path

MEDIUM 41

This affects the package object-path before 0.11.6.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01902 Published 2021-08-27 Partial fix · 0.11.6 CWE-843

TI-2021-12355 CVE-2021-32687

Integer overflow issue with intsets in Redis

MEDIUM 40

Redis is an open source, in-memory database that persists on disk.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.04092 Published 2021-10-04 Partial fix · 5.0.14, 6.0.16 +1 CWE-190

TI-2021-12296 CVE-2021-32627

Integer overflow issue with Streams in Redis

MEDIUM 40

Redis is an open source, in-memory database that persists on disk.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.03964 Published 2021-10-04 Partial fix · 5.0.14, 6.0.16 +1 CWE-190

TI-2021-17941 CVE-2021-41099

Integer overflow issue with strings in Redis

LOW 39

Redis is an open source, in-memory database that persists on disk.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.03648 Published 2021-10-04 Partial fix · 5.0.14, 6.0.16 CWE-190

TI-2021-02726 CVE-2021-3795 · GHSA-44c6-4v22-4mhx

Inefficient Regular Expression Complexity in sindresorhus/semver-regex

LOW 36

semver-regex is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01517 Published 2021-09-15 Partial fix · 4.0.1, 3.1.3 CWE-1333

TI-2021-12340 CVE-2021-32672

Vulnerability in Lua Debugger in Redis

LOW 27

Redis is an open source, in-memory database that persists on disk.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0169 Published 2021-10-04 Partial fix · 5.0.14, 6.0.16 +1 CWE-125