Red Hat Security Advisory

RHSA-2024:6211

Red Hat OpenShift Service Mesh Containers for 2.6.1 security update

Released 2024-09-03 · Red Hat rating Important · View on Red Hat →

Fixed in

RHOSSM 2.6 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +6
RHOSSM 2.6 for RHEL 9 openshift-service-mesh/proxyv2-rhel9

TI-2024-26292 CVE-2024-39338 · GHSA-8hc4-vh64-cxmj

HIGH 66

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01207 Published 2024-08-09 Partial fix · 1.7.4 CWE-918

TI-2024-03788 CVE-2024-4068 · GHSA-grv7-fg5c-xmjg

MEDIUM 42

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01471 Published 2024-05-13 Partial fix · 3.0.3 CWE-1050

TI-2024-03787 CVE-2024-4067 · GHSA-952p-6rrq-rcjv

LOW 33

The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01429 Published 2024-05-13 Partial fix · 4.0.8 CWE-1333

TI-2024-19223 CVE-2024-29041 · GHSA-rv95-896h-c2vc

LOW 29

Express.js minimalist web framework for node.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00786 Published 2024-03-25 Partial fix · 4.19.0, 5.0.0-beta.3 +1 CWE-1286