Red Hat Security AdvisoryRHSA-2024:6209
Red Hat OpenShift Service Mesh Containers for 2.4.10 security update
Released 2024-09-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHOSSM 2.4 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +4
Fixes 5 records
Priority HIGH 66
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01207 · Published 2024-08-09 · Partial fix · 1.7.4 CWE-918
Priority MEDIUM 63
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00459 · Published 2024-08-02 · Partial fix · 6.5.7 CWE-130
Priority MEDIUM 63
In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00302 · Published 2024-08-02 · Partial fix · 6.5.7 CWE-347
Priority MEDIUM 46
In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00617 · Published 2024-08-02 · Partial fix · 6.5.7 CWE-347
Priority LOW 26
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.01956 · Published 2024-03-09 · Partial fix · 4.0.1, 3.0.3 +1 CWE-409
THREATIST.IORead the docs