Red Hat Security Advisory

RHSA-2021:4902

ACS 3.67 security and enhancement update

Released 2021-12-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHACS 3.67 for RHEL 8 advanced-cluster-security/rhacs-rhel8-operator

Fixes 7 records

TI-2020-16622 CVE-2020-27304 · GHSA-wphm-mh7c-38cf

Path traversal in civetweb_project civetweb

MEDIUM 48

The CivetWeb web library does not validate uploaded filepaths when running on an OS other than Windows, when using the built-in HTTP form-based file upload mechanism, via the mg_handle_form_request API.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03268 Published 2021-10-21 Partial fix · 1.15 CWE-23

TI-2021-02682 CVE-2021-3749 · GHSA-cph5-m8f7-6c5x

Inefficient Regular Expression Complexity in axios/axios

MEDIUM 44

axios is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.08515 Published 2021-08-31 Partial fix · 0.21.2 CWE-1333

TI-2021-16667 CVE-2021-39293 · GHSA-j532-8pqq-78jr

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header…

MEDIUM 43

In archive/zip in Go before 1.16.8 and 1.17.x before 1.17.1, a crafted archive header (falsely designating that many files are present) can cause a NewReader or OpenReader panic.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.06934 Published 2022-01-24 Partial fix CWE-770

TI-2021-12358 CVE-2021-32690 · GHSA-56hp-xqp3-w2jf

Repository credentials passed to alternate domain

MEDIUM 40

Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources).

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01434 Published 2021-06-16 Partial fix · 3.6.1 CWE-200

TI-2021-10545 CVE-2021-29923 · GHSA-38h6-vxp4-qxvm

Go before 1.17 does not properly consider extraneous zero characters at the beginning of…

LOW 39

Go before 1.17 does not properly consider extraneous zero characters at the beginning of an IP address octet, which (in some situations) allows attackers to bypass access control that is based on IP addresses, because of…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03744 Published 2021-08-07 Partial fix

TI-2021-06041 CVE-2021-23343 · GHSA-hj48-42vr-x3v9

Regular expression denial of service (ReDoS) in path-parse

LOW 37

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02218 Published 2021-05-04 Partial fix · 1.0.7 CWE-400

TI-2021-02732 CVE-2021-3801 · GHSA-hqhp-5p83-hx96

Inefficient Regular Expression Complexity in prismjs/prism

LOW 31

prism is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01036 Published 2021-09-15 Partial fix · 1.25.0 CWE-1333