Read the docs
Red Hat Security Advisory

RHSA-2022:7276

Red Hat Advanced Cluster Management 2.4.8 security fixes and container updates

Released 2022-11-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 5 records

TI-2022-16376 CVE-2022-35949 · GHSA-8qr4-xgw6-wmr3

`undici.request` vulnerable to SSRF using absolute URL on `pathname`

Priority HIGH 81

undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user input** into the `path/pathname` option of `undici.request`.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01927 Published 2022-08-12 Partial fix · 5.8.2 CWE-918
TI-2022-13173 CVE-2022-31129 · GHSA-wc69-rhjr-hc9g

Inefficient Regular Expression Complexity in moment

Priority HIGH 72

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05551 Published 2022-07-06 Partial fix · 2.29.4 CWE-400
TI-2022-16375 CVE-2022-35948 · GHSA-f772-66g8-q5h3

CRLF Injection in Nodejs ‘undici’ via Content-Type

Priority MEDIUM 63

undici is an HTTP/1.1 client, written from scratch for Node.js.`=< [email protected]` users are vulnerable to _CRLF Injection_ on headers when using unsanitized input as request headers, more specifically, inside the `content…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01391 Published 2022-08-13 Partial fix · 5.8.2 CWE-74
TI-2022-09424 CVE-2022-25858 · GHSA-4wf5-vphf-c2xc

Regular expression denial of service (ReDoS) in terser

Priority LOW 39

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03253 Published 2022-07-15 Partial fix · 4.8.1, 5.14.2 CWE-1333
TI-2022-02066 CVE-2022-2238 · GHSA-gpp7-gqhm-5827

SQL injection in Red Hat Advanced Cluster Management for Kubernetes

Priority LOW 31

A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00937 Published 2022-09-01 Partial fix CWE-89