Red Hat Security AdvisoryRHSA-2024:0041
OpenShift Container Platform 4.16.0 bug fix and security update
Released 2024-06-27 · Red Hat rating Critical · View on Red Hat →
Fixes 17 records
Priority HIGH 72
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02026 · Published 2023-11-10 · Partial fix · 0.46.0 CWE-770
Priority HIGH 70
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.93547 · Published 2023-12-18 · Partial fix · 0.40.2, 0.17.0 +2 CWE-354
Priority HIGH 66
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01226 · Published 2024-03-21 · Partial fix · 7.1.0, 6.1.2 +1 CWE-22
Priority MEDIUM 62
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01044 · Published 2024-03-14 · Partial fix · 1.15.6 CWE-200
Priority MEDIUM 52
A path traversal vulnerability was discovered in go-git versions prior to v5.11.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0151 · Published 2024-01-12 · Partial fix · 5.11.0 CWE-22
Priority MEDIUM 48
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0068 · Published 2024-03-03 · Partial fix CWE-200
Priority MEDIUM 41
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01262 · Published 2024-03-05 · Partial fix · 1.33.0 CWE-835
Priority MEDIUM 41
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0105 · Published 2024-03-05 · Partial fix · 1.21.8, 1.22.1
Priority MEDIUM 41
quic-go is an implementation of the QUIC protocol in Go.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01109 · Published 2024-04-04 · Partial fix · 0.42.0 CWE-770
Priority MEDIUM 40
Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00661 · Published 2024-03-06 · Fixed in 2.15.2 CWE-522
Priority LOW 36
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01614 · Published 2023-10-12 · Partial fix · 0.44.0 CWE-770
Priority LOW 31
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02102 · Published 2024-03-09 · Partial fix · 2.0.7, 4.15.5 CWE-400
Priority LOW 31
A flaw was found in coredns.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0076 · Published 2024-04-25 · Partial fix · 1.11.2, v4.13.0-202408260940.p0.ge70f097.assembly.stream.el8 +3 CWE-524
Priority LOW 28
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00667 · Published 2024-03-05 · Partial fix · 1.21.8, 1.22.1 CWE-476
Priority LOW 26
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.01956 · Published 2024-03-09 · Partial fix · 4.0.1, 3.0.3 +1 CWE-409
Priority LOW 26
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00795 · Published 2024-03-05 · Partial fix · 1.21.8, 1.22.1
Priority LOW 22
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie".
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.0108 · Published 2024-03-05 · Partial fix · 1.21.8, 1.22.1
THREATIST.IORead the docs