RHSA-2024:6122

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were n…

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization.

A flaw was found in openshift/builder.

A flaw was found in rsync which could be triggered when rsync compares file checksums.

An insufficient entropy vulnerability was found in the Openshift Console.

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

A flaw was found in OpenShift.

go-git is a highly extensible git implementation library written in pure Go.

path-to-regexp turns path strings into a regular expressions.

path-to-regexp turns path strings into a regular expressions.

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.

go-git is a highly extensible git implementation library written in pure Go.

A flaw was found in the github.com/containers/image library.

A flaw was found in Go.

A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames.

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

An issue was discovered in PostCSS before 8.4.31.

A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query.

A denial of service (DoS) vulnerability was found in OpenShift.

An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability (CVE-2023-39325/CVE-2023-44487) where only unauthenticated streams were protected, not streams created by authenticated source…

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file.

In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lack of checksum validation of supplied image_source URLs when configured to conver…

The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3.