Red Hat Security AdvisoryRHSA-2024:6121
OpenShift Container Platform 4.18.1 security and extras update
Released 2025-02-25 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.18 openshift4/ingress-node-firewall-rhel9, openshift4/ingress-node-firewall-rhel9-operator, openshift4/kube-compare-artifacts-rhel9 +47
Fixes 13 records
Priority HIGH 77
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00868 · Published 2024-11-08 · Partial fix · 6.0.6, 7.0.5 +1 CWE-1333
Priority MEDIUM 53
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.03181 · Published 2024-12-11 · Partial fix · 0.31.0 CWE-285
Priority MEDIUM 51
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01151 · Published 2024-10-31 · Partial fix · 2.4.2 CWE-1321
Priority MEDIUM 48
An issue was discovered in Cloud Native Computing Foundation (CNCF) Helm through 3.13.3.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0068 · Published 2024-03-03 · Partial fix CWE-200
Priority MEDIUM 44
go-git is a highly extensible git implementation library written in pure Go.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.01278 · Published 2025-01-06 · Partial fix · 5.13.0 CWE-88
Priority MEDIUM 41
path-to-regexp turns path strings into a regular expressions.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.00787 · Published 2024-12-05 · Partial fix · 0.1.12 CWE-1333
Priority MEDIUM 40
go-git is a highly extensible git implementation library written in pure Go.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00717 · Published 2025-01-06 · Partial fix · 5.13.0 CWE-400
Priority MEDIUM 40
body-parser is Node.js body parsing middleware.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00824 · Published 2024-09-10 · Partial fix · 1.20.3 CWE-405
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01072 · Published 2024-12-18 · Partial fix · 0.33.0 CWE-1333
Priority LOW 32
An issue was discovered in PostCSS before 8.4.31.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00973 · Published 2023-09-29 · Partial fix · 8.4.31 CWE-74
Priority LOW 27
Jinja is an extensible templating engine.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00522 · Published 2024-12-23 · Partial fix · 3.1.5 CWE-1336
Priority LOW 26
Jinja is an extensible templating engine.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00307 · Published 2024-12-23 · Partial fix · 3.1.5 CWE-150
Priority LOW 21
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00665 · Published 2024-12-09 · Partial fix · 5.0.9, 3.3.8 CWE-835
THREATIST.IORead the docs