Red Hat Security Advisory

RHSA-2023:3265

Red Hat OpenShift Data Foundation 4.12.3 Security and Bug fix update

Released 2023-05-23 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHODF 4.12 for RHEL 8 odf4/mcg-core-rhel8

Fixes 2 records

TI-2022-08786 CVE-2022-24999 · GHSA-hrpp-h998-j3pp

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers…

HIGH 72

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.15695 Published 2022-11-26 Partial fix · 6.10.3, 6.9.7 +7 CWE-1321

TI-2022-07594 CVE-2022-23539 · GHSA-8cf7-32gw-wr33

jsonwebtoken unrestricted key type could lead to legacy keys usage

LOW 36

Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00524 Published 2022-12-22 Partial fix · 9.0.0 CWE-327