Red Hat Security AdvisoryRHSA-2024:7213
Updated service-interconnect rhel9 container images for 1.4 LTS
Released 2024-09-26 · Red Hat rating Low · View on Red Hat →
Fixed in
- 9Base-Service-Interconnect-1.4 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-flow-collector-rhel9, service-interconnect/skupper-operator-bundle +3
Fixes 10 records
Priority HIGH 75
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.66582 · Published 2024-09-03 · Partial fix · 3.3.2, 3.2.3 +2 CWE-843
Priority HIGH 73
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01939 · Published 2024-07-15 · Partial fix · 70.0, 70.0.0 CWE-94
Priority HIGH 69
When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.36081 · Published 2024-03-27 · Partial fix CWE-772
Priority MEDIUM 60
There is a MEDIUM severity vulnerability affecting CPython.
CVSS 3.1MEDIUM 5.5· Network · Low privileges · User interaction · EPSS 0.011 · Published 2024-08-01 · Partial fix · 3.8.20, 3.9.20 +4 CWE-94
Priority MEDIUM 52
An issue was discovered in libexpat before 2.6.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01686 · Published 2024-08-30 · Partial fix CWE-190
Priority MEDIUM 51
An issue was discovered in libexpat before 2.6.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01393 · Published 2024-08-30 · Partial fix CWE-190
Priority MEDIUM 50
An issue was discovered in libexpat before 2.6.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0113 · Published 2024-08-30 · Partial fix CWE-190
Priority MEDIUM 43
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01863 · Published 2024-06-28 · Partial fix CWE-125
Priority LOW 34
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00748 · Published 2024-06-28 · Partial fix CWE-345
Priority LOW 25
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1.
CVSS 3.1MEDIUM 5.2· Physical · No auth · No interaction · EPSS 0.00763 · Published 2024-05-07 · Partial fix CWE-290
THREATIST.IORead the docs