Red Hat Security AdvisoryRHSA-2024:8676
Red Hat OpenShift Data Foundation 4.17.0 Security, Enhancement, & Bug Fix Update
Released 2024-10-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHODF 4.17 for RHEL 9 odf4/mcg-core-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +3
Fixes 12 records
Priority HIGH 81
Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02627 · Published 2023-07-01 · Partial fix · 4.1.3 CWE-1321
Priority MEDIUM 63
@adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while attempting to parse CSS.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01154 · Published 2023-11-17 · Partial fix · 4.3.1 CWE-20
Priority MEDIUM 62
Webpack is a module bundler.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00959 · Published 2024-08-27 · Partial fix · 5.94.0 CWE-79
Priority MEDIUM 58
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00443 · Published 2024-06-05 · Partial fix · 1.21.11, 1.22.4
Priority MEDIUM 41
path-to-regexp turns path strings into a regular expressions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00932 · Published 2024-09-09 · Partial fix · 0.1.10, 8.0.0 +3 CWE-1333
Priority MEDIUM 41
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01262 · Published 2024-03-05 · Partial fix · 1.33.0 CWE-835
Priority MEDIUM 40
body-parser is Node.js body parsing middleware.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00824 · Published 2024-09-10 · Partial fix · 1.20.3 CWE-405
Priority MEDIUM 40
fast-xml-parser is an open source, pure javascript xml parser.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00828 · Published 2024-07-29 · Partial fix · 4.4.1 CWE-400
Priority LOW 31
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02102 · Published 2024-03-09 · Partial fix · 2.0.7, 4.15.5 CWE-400
Priority LOW 24
serve-static serves static files.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00631 · Published 2024-09-10 · Partial fix · 1.16.0, 2.1.0 CWE-79
Priority LOW 24
Send is a library for streaming files from the file system as a http response.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00541 · Published 2024-09-10 · Partial fix · 0.19.0 CWE-79
Priority LOW 23
Express.js minimalist web framework for node.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00486 · Published 2024-09-10 · Partial fix · 4.20.0, 5.0.0 CWE-79
THREATIST.IORead the docs