Red Hat Security AdvisoryRHSA-2023:1428
Migration Toolkit for Containers (MTC) 1.7.8 security and bug fix update
Released 2023-03-23 · Red Hat rating Important · View on Red Hat →
Fixed in
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-ui-rhel8
Fixes 8 records
Priority HIGH 72
Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01774 · Published 2023-01-25 · Partial fix · 0.7.33, 1.0.33 CWE-1333
Priority HIGH 72
qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.15695 · Published 2022-11-26 · Partial fix · 6.10.3, 6.9.7 +7 CWE-1321
Priority HIGH 72
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01545 · Published 2022-12-27 · Partial fix · 1.6.0 CWE-116
Priority HIGH 68
This affects versions of the package http-cache-semantics before 4.1.1.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01613 · Published 2023-01-31 · Partial fix · 4.1.1 CWE-1333
Priority HIGH 66
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.2361 · Published 2022-11-28 · Partial fix · 0.2.1 CWE-20
Priority MEDIUM 50
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.09698 · Published 2022-12-24 · Partial fix · 2.2.2, 1.0.2 CWE-1321
Priority MEDIUM 44
A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02702 · Published 2022-10-14 · Partial fix · 1.4.2, 2.0.4 +1 CWE-1333
Priority MEDIUM 43
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.01411 · Published 2023-01-29 · Partial fix · 3.8.0 CWE-22
THREATIST.IORead the docs