Red Hat Security AdvisoryRHSA-2022:5069
OpenShift Container Platform 4.11.0 bug fix and security update
Released 2022-08-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.11 openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8, openshift4/ose-alibaba-machine-controllers-rhel8, openshift4/ose-aws-ebs-csi-driver-rhel8 +47
Fixes 13 records
Priority MEDIUM 56
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04581 · Published 2022-03-17 · Partial fix · 1.2.6, 0.2.4 CWE-1321
Priority MEDIUM 48
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.05994 · Published 2022-02-15 · Partial fix · 1.11.1 CWE-400
Priority MEDIUM 46
go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, endless redirect, and configuration bypass via abuse of custom HTTP response header processing.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01743 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0 CWE-77
Priority MEDIUM 43
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.03114 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0 CWE-22
Priority MEDIUM 40
go-getter up to 1.5.11 and 2.0.2 panicked when processing password-protected ZIP files.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01462 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0
Priority MEDIUM 40
go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource exhaustion when go-getter processed malicious HTTP responses.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01462 · Published 2022-05-25 · Partial fix · 1.6.1, 2.1.0
Priority MEDIUM 40
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03963 · Published 2022-03-18 · Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327
Priority LOW 35
The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01193 · Published 2022-09-06 · Partial fix · 0.0.0-20211202192323-5770296d904e
Priority LOW 31
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01653 · Published 2022-01-16 · Partial fix · 3.1.1, 2.6.7 CWE-200
Priority LOW 30
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper sanitization in sanitizeUrl function.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0143 · Published 2022-03-16 · Partial fix · 6.0.0 CWE-79
Priority LOW 27
The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content.
CVSS 3.1MEDIUM 5.0· Network · Low privileges · No interaction · EPSS 0.02223 · Published 2021-11-17 · Partial fix · 1.0.1 CWE-843
Priority LOW 25
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.0041 · Published 2022-04-27 · Partial fix · 1.5.11 CWE-532
Priority LOW 25
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00473 · Published 2022-01-14 · Partial fix · 3.1.31 CWE-704
THREATIST.IORead the docs