Red Hat Security Advisory

RHSA-2024:1946

Red Hat OpenShift Service Mesh Containers for 2.5.1 security update

Released 2024-04-22 · Red Hat rating Moderate · View on Red Hat →

Fixed in

RHOSSM 2.5 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +7

Fixes 4 records

TI-2023-11383 CVE-2023-26159 · GHSA-jchw-25xp-jwwc

Improper input validation in follow-redirects

HIGH 65

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00797 Published 2024-01-02 Partial fix · 1.15.4 CWE-20

TI-2024-19051 CVE-2024-28849 · GHSA-cxjh-pqwp-8mfp

Proxy-Authorization header kept across hosts in follow-redirects

MEDIUM 62

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01044 Published 2024-03-14 Partial fix · 1.15.6 CWE-200

TI-2024-16303 CVE-2024-24786 · GHSA-8r3f-844c-mc37

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

MEDIUM 41

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01262 Published 2024-03-05 Partial fix · 1.33.0 CWE-835

TI-2024-18756 CVE-2024-28180 · GHSA-c5q2-7r4c-mv6g

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

LOW 26

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01956 Published 2024-03-09 Partial fix · 4.0.1, 3.0.3 +1 CWE-409