Red Hat Security AdvisoryRHSA-2024:7922
OpenShift Container Platform 4.17.1 bug fix and security update
Released 2024-10-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.17 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
Fixes 9 records
Priority HIGH 73
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01939 · Published 2024-07-15 · Partial fix · 70.0, 70.0.0 CWE-94
Priority HIGH 70
pgx is a PostgreSQL driver and toolkit for Go.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00847 · Published 2024-03-06 · Partial fix · 4.18.2 CWE-89
Priority HIGH 70
An insufficient entropy vulnerability was found in the Openshift Console.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.00673 · Published 2024-08-21 · Fixed in v4.12.0-202412201659.p0.g8910d84.assembly.stream.el8, v4.13.0-202411300029.p0.g68accd9.assembly.stream.el8 +167 CWE-331
Priority MEDIUM 42
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01414 · Published 2024-07-02 · Partial fix · 1.21.12, 1.22.5
Priority MEDIUM 41
path-to-regexp turns path strings into a regular expressions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00932 · Published 2024-09-09 · Partial fix · 0.1.10, 8.0.0 +3 CWE-1333
Priority MEDIUM 41
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01262 · Published 2024-03-05 · Partial fix · 1.33.0 CWE-835
Priority LOW 39
A flaw was found in the github.com/containers/image library.
CVSS 3.1HIGH 8.3· Network · No auth · User interaction · EPSS 0.01279 · Published 2024-05-09 · Partial fix · 5.29.3, 5.30.1 +66 CWE-354
Priority LOW 31
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not app…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01165 · Published 2024-03-05 · Partial fix · 1.21.8, 1.22.1 CWE-770
Priority LOW 25
HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00613 · Published 2023-07-31 · Partial fix · 1.13.5, 1.14.1 CWE-203
THREATIST.IORead the docs