Red Hat Security AdvisoryRHSA-2024:10186
ACS 4.5 enhancement update
Released 2024-11-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHACS 4.5 for RHEL 8 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-roxctl-rhel8 +3
Fixes 6 records
Priority HIGH 77
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00868 · Published 2024-11-08 · Partial fix · 6.0.6, 7.0.5 +1 CWE-1333
Priority MEDIUM 58
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00443 · Published 2024-06-05 · Partial fix · 1.21.11, 1.22.4
Priority MEDIUM 53
The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01952 · Published 2024-06-05 · Partial fix · 1.21.11, 1.22.4
Priority MEDIUM 51
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01151 · Published 2024-10-31 · Partial fix · 2.4.2 CWE-1321
Priority MEDIUM 41
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01127 · Published 2024-09-06 · Partial fix · 1.22.7, 1.23.1
Priority MEDIUM 40
body-parser is Node.js body parsing middleware.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00824 · Published 2024-09-10 · Partial fix · 1.20.3 CWE-405
THREATIST.IORead the docs