Red Hat Security Advisory

RHSA-2022:1739

Red Hat OpenShift Service Mesh 2.1.2.1 containers security update

Released 2022-05-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

TI-2021-20323 CVE-2021-44906 · GHSA-xvch-5gv4-984h

MEDIUM 56

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04581 Published 2022-03-17 Partial fix · 1.2.6, 0.2.4 CWE-1321

TI-2022-08586 CVE-2022-24772 · GHSA-x4jg-mjrx-434g

MEDIUM 41

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01112 Published 2022-03-18 Partial fix · 1.3.0 CWE-347

TI-2022-08585 CVE-2022-24771 · GHSA-cfm4-qjh2-4765

MEDIUM 40

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00779 Published 2022-03-18 Partial fix · 1.3.0 CWE-347

TI-2022-08587 CVE-2022-24773 · GHSA-2r2c-g63r-vccr

LOW 32

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00956 Published 2022-03-18 Partial fix · 1.3.0 CWE-347

TI-2022-00171 CVE-2022-0235 · GHSA-r683-j2x4-v87g

LOW 31

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01653 Published 2022-01-16 Partial fix · 3.1.1, 2.6.7 CWE-200

TI-2022-00456 CVE-2022-0536 · GHSA-pw2r-vq6v-hr8c

LOW 29

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01337 Published 2022-02-09 Partial fix · 1.14.8 CWE-212