Read the docs
Red Hat Security Advisory

RHSA-2024:6755

Red Hat OpenShift Data Foundation 4.16.2 security and bug fix update

Released 2024-09-18 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 8 records

TI-2024-19349 CVE-2024-29180 · GHSA-wr3j-pwj9-hqq6

webpack-dev-middleware Path Traversal vulnerability

Priority HIGH 66

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01226 Published 2024-03-21 Partial fix · 7.1.0, 6.1.2 +1 CWE-22
TI-2024-16306 CVE-2024-24789 · GHSA-236w-p7wf-5ph8

Mishandling of corrupt central directory record in archive/zip

Priority MEDIUM 58

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00443 Published 2024-06-05 Partial fix · 1.21.11, 1.22.4
TI-2024-27861 CVE-2024-41818 · GHSA-mpg4-rc92-vx8v

ReDOS at currency parsing fast-xml-parser

Priority MEDIUM 40

fast-xml-parser is an open source, pure javascript xml parser.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00828 Published 2024-07-29 Partial fix · 4.4.1 CWE-400
TI-2023-20466 CVE-2023-39325 · GHSA-4374-p667-p6c8

HTTP/2 rapid reset can cause excessive work in net/http

Priority LOW 39

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03796 Published 2023-10-11 Partial fix · 1.20.10, 1.21.3 +1 CWE-770
TI-2024-18754 CVE-2024-28176 · GHSA-hhhv-q57g-882q

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

Priority LOW 31

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.02102 Published 2024-03-09 Partial fix · 2.0.7, 4.15.5 CWE-400