TI-2022-16490 CVE-2022-36067 · GHSA-mrgp-mrhc-5jrq
vm2 vulnerable to Sandbox Escape before v3.9.11
Priority HIGH 82
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
RHSA-2022:6696
Red Hat Advanced Cluster Management 2.4.6 security update and bug fixes
Released 2022-09-26 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
Fixes 5 records
TI-2022-13173 CVE-2022-31129 · GHSA-wc69-rhjr-hc9g
Inefficient Regular Expression Complexity in moment
Priority HIGH 72
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates.
TI-2022-13193 CVE-2022-31150 · GHSA-3cvr-822r-rqcc
CRLF injection in request headers
Priority HIGH 68
undici is an HTTP/1.1 client, written from scratch for Node.js.
TI-2022-13194 CVE-2022-31151 · GHSA-q768-x9m6-m9qp
Uncleared cookies on cross-host/cross-origin redirect in undici
Priority MEDIUM 62
Authorization headers are cleared on cross-origin redirect.
TI-2022-12765 CVE-2022-30629 · GHSA-j55j-52j7-vq87
Session tickets lack random ticket_age_add in crypto/tls
Priority LOW 18
Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during…