Red Hat Security AdvisoryRHSA-2023:0934
Migration Toolkit for Applications security and bug fix update
Released 2023-02-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- MTA 6.0 for RHEL 8 mta/mta-admin-addon-rhel8, mta/mta-hub-rhel8, mta/mta-ui-rhel8 +1
Fixes 8 records
Priority HIGH 82
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03503 · Published 2022-10-12 · Partial fix · 2.0.3, 1.4.1 CWE-1321
Priority HIGH 72
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.15695 · Published 2022-11-26 · Partial fix · 6.10.3, 6.9.7 +7 CWE-1321
Priority HIGH 72
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01545 · Published 2022-12-27 · Partial fix · 1.6.0 CWE-116
Priority HIGH 66
The glob-parent package before 6.0.1 for Node.js allows ReDoS (regular expression denial of service) attacks against the enclosure regular expression.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01696 · Published 2022-12-26 · Partial fix · 6.0.1 CWE-1333
Priority MEDIUM 50
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.09698 · Published 2022-12-24 · Partial fix · 2.2.2, 1.0.2 CWE-1321
Priority MEDIUM 48
Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03501 · Published 2022-11-07 · Partial fix · 6.6.0 CWE-787
Priority MEDIUM 44
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02702 · Published 2022-10-14 · Partial fix · 1.4.2, 2.0.4 +1 CWE-1333
Priority LOW 33
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.06077 · Published 2022-12-08 · Partial fix · 1.18.9, 1.19.4 +1 CWE-770
THREATIST.IORead the docs