Read the docs
Red Hat Security Advisory

RHSA-2024:6667

Red Hat OpenShift Dev Spaces 3.16.0 release

Released 2024-09-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2024-05888 CVE-2024-6345 · GHSA-cx63-2mw6-8hw5

Remote Code Execution in pypa/setuptools

Priority HIGH 73

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01939 Published 2024-07-15 Partial fix · 70.0, 70.0.0 CWE-94
TI-2024-14824 CVE-2024-22234 · GHSA-w3w6-26f2-p474

CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated

Priority LOW 36

In Spring Security, versions 6.1.x prior to 6.1.7 and versions 6.2.x prior to 6.2.2, an application is vulnerable to broken access control when it directly uses the AuthenticationTrustResolver.isFullyAuthenticated(Authen…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00682 Published 2024-02-20 Partial fix · 6.1.7, 6.2.2 CWE-284
TI-2023-03393 CVE-2023-3635 · GHSA-w33c-445m-f8w7

Okio GzipSource unhandled exception Denial of Service

Priority LOW 35

GzipSource does not handle an exception that might be raised when parsing a malformed gzip buffer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01254 Published 2023-07-12 Partial fix · 1.17.6, 3.4.0 CWE-195
TI-2021-00272 CVE-2021-0341 · GHSA-3cqm-mf7h-prrj

Improper certificate validation in Android

Priority LOW 35

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00915 Published 2021-02-10 Partial fix · 4.9.2 CWE-295