Red Hat Security AdvisoryRHSA-2024:8014
Network Observability 1.7.0 for OpenShift
Released 2024-10-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- NETOBSERV 1.7 for RHEL 9 network-observability/network-observability-cli-rhel9, network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-ebpf-agent-rhel9 +3
Fixes 11 records
Priority HIGH 66
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01207 · Published 2024-08-09 · Partial fix · 1.7.4 CWE-918
Priority MEDIUM 62
Webpack is a module bundler.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00959 · Published 2024-08-27 · Partial fix · 5.94.0 CWE-79
Priority MEDIUM 41
path-to-regexp turns path strings into a regular expressions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00932 · Published 2024-09-09 · Partial fix · 0.1.10, 8.0.0 +3 CWE-1333
Priority MEDIUM 41
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01046 · Published 2024-09-06 · Partial fix · 1.22.7, 1.23.1 CWE-674
Priority MEDIUM 41
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01127 · Published 2024-09-06 · Partial fix · 1.22.7, 1.23.1
Priority MEDIUM 40
body-parser is Node.js body parsing middleware.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00824 · Published 2024-09-10 · Partial fix · 1.20.3 CWE-405
Priority LOW 34
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00894 · Published 2024-09-16 · Partial fix · 2.5.4, 3.1.3 CWE-1333
Priority LOW 24
serve-static serves static files.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00631 · Published 2024-09-10 · Partial fix · 1.16.0, 2.1.0 CWE-79
Priority LOW 24
Send is a library for streaming files from the file system as a http response.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00541 · Published 2024-09-10 · Partial fix · 0.19.0 CWE-79
Priority LOW 23
Express.js minimalist web framework for node.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00486 · Published 2024-09-10 · Partial fix · 4.20.0, 5.0.0 CWE-79
Priority LOW 22
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00839 · Published 2024-09-06 · Partial fix · 1.22.7, 1.23.1
THREATIST.IORead the docs