Read the docs
Red Hat Security Advisory

RHSA-2024:3989

Migration Toolkit for Applications security and bug fix update

Released 2024-06-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 14 records

TI-2024-01049 CVE-2024-1132 · GHSA-72vp-xfrc-42xm

Keycloak: path transversal in redirection validation

Priority HIGH 70

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01552 Published 2024-04-17 Partial fix · 22.0.10, 24.0.3 +12 CWE-22
TI-2023-24614 CVE-2023-45857 · GHSA-wf5p-g6vw-rhxx

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN…

Priority HIGH 68

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensiti…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00729 Published 2023-11-08 Partial fix · 1.6.0, 0.28.0 CWE-352
TI-2024-19349 CVE-2024-29180 · GHSA-wr3j-pwj9-hqq6

webpack-dev-middleware Path Traversal vulnerability

Priority HIGH 66

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01226 Published 2024-03-21 Partial fix · 7.1.0, 6.1.2 +1 CWE-22
TI-2023-11383 CVE-2023-26159 · GHSA-jchw-25xp-jwwc

Improper input validation in follow-redirects

Priority HIGH 65

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00797 Published 2024-01-02 Partial fix · 1.15.4 CWE-20
TI-2023-11514 CVE-2023-26364 · GHSA-hpx4-r86g-5jrg

Denial of Service of regular expression in package @adobe/css-tools

Priority MEDIUM 63

@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01154 Published 2023-11-17 Partial fix · 4.3.1 CWE-20
TI-2024-19051 CVE-2024-28849 · GHSA-cxjh-pqwp-8mfp

Proxy-Authorization header kept across hosts in follow-redirects

Priority MEDIUM 62

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01044 Published 2024-03-14 Partial fix · 1.15.6 CWE-200
TI-2023-26480 CVE-2023-48631 · GHSA-prr3-c3m5-p7q2

Denial of Service of regular expression in package @adobe/css-tools

Priority LOW 35

@adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01111 Published 2023-12-14 Partial fix · 4.3.2 CWE-20
TI-2024-19306 CVE-2024-29133 · GHSA-9w38-p64v-xpmv

Out-of-bounds write in Apache Commons Configuration

Priority LOW 28

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01727 Published 2024-03-21 Partial fix · 2.10.1 CWE-787
TI-2024-17389 CVE-2024-26308 · GHSA-4265-ccf5-phj5

Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

Priority LOW 27

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26.

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.00898 Published 2024-02-19 Partial fix · 1.26.0 CWE-770
TI-2023-18320 CVE-2023-36479 · GHSA-3gh6-v5v9-6v9j

Jetty vulnerable to errant command quoting in CGI Servlet

Priority LOW 19

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project.

CVSS 3.1LOW 3.5 Network Low privileges No interaction EPSS 0.01162 Published 2023-09-15 Partial fix · 9.4.52, 10.0.16 +2 CWE-149