Red Hat Security AdvisoryRHSA-2023:0264
Red Hat OpenShift (Logging Subsystem) security update
Released 2023-01-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHOL 5.6 for RHEL 8 openshift-logging/elasticsearch6-rhel8, openshift-logging/logging-loki-rhel8, openshift-logging/logging-view-plugin-rhel8
Fixes 9 records
Priority HIGH 82
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03503 · Published 2022-10-12 · Partial fix · 2.0.3, 1.4.1 CWE-1321
Priority MEDIUM 47
jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0486 · Published 2022-03-11 · Partial fix · 2.13.2.1, 2.12.6.1 CWE-787
Priority MEDIUM 45
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03409 · Published 2022-10-02 · Partial fix · 2.12.7.1, 2.13.4 CWE-502
Priority LOW 39
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03409 · Published 2022-10-02 · Partial fix · 2.12.7.1, 2.13.4.2 CWE-502
Priority LOW 39
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03487 · Published 2022-09-06 · Partial fix · 0.0.0-20220906165146-f3363e06e74c
Priority LOW 37
JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02296 · Published 2022-09-13 · Partial fix · 1.19.1 CWE-22
Priority LOW 37
Reader.Read does not set a limit on the maximum size of file headers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02006 · Published 2022-10-14 · Partial fix · 1.18.7, 1.19.2 CWE-770
Priority LOW 36
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01726 · Published 2022-10-14 · Partial fix · 1.18.7, 1.19.2
Priority LOW 36
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01408 · Published 2022-10-14 · Partial fix · 1.18.7, 1.19.2 CWE-444
THREATIST.IORead the docs