Red Hat Security AdvisoryRHSA-2025:0875
OpenShift Container Platform 4.17.15 security and extras update
Released 2025-02-05 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9, openshift4/ose-ansible-rhel9-operator, openshift4/ose-helm-rhel9-operator +2
Fixes 12 records
Priority HIGH 77
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00868 · Published 2024-11-08 · Partial fix · 6.0.6, 7.0.5 +1 CWE-1333
Priority MEDIUM 51
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01151 · Published 2024-10-31 · Partial fix · 2.4.2 CWE-1321
Priority MEDIUM 41
path-to-regexp turns path strings into a regular expressions.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.00787 · Published 2024-12-05 · Partial fix · 0.1.12 CWE-1333
Priority MEDIUM 41
path-to-regexp turns path strings into a regular expressions.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00932 · Published 2024-09-09 · Partial fix · 0.1.10, 8.0.0 +3 CWE-1333
Priority MEDIUM 40
body-parser is Node.js body parsing middleware.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00824 · Published 2024-09-10 · Partial fix · 1.20.3 CWE-405
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01072 · Published 2024-12-18 · Partial fix · 0.33.0 CWE-1333
Priority LOW 27
Jinja is an extensible templating engine.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00522 · Published 2024-12-23 · Partial fix · 3.1.5 CWE-1336
Priority LOW 26
Jinja is an extensible templating engine.
CVSS 4.0MEDIUM 5.4· Local · Low privileges · User interaction · EPSS 0.00307 · Published 2024-12-23 · Partial fix · 3.1.5 CWE-150
Priority LOW 24
serve-static serves static files.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00631 · Published 2024-09-10 · Partial fix · 1.16.0, 2.1.0 CWE-79
Priority LOW 24
Send is a library for streaming files from the file system as a http response.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00541 · Published 2024-09-10 · Partial fix · 0.19.0 CWE-79
Priority LOW 23
Express.js minimalist web framework for node.
CVSS 3.1MEDIUM 5.0· Network · No auth · User interaction · EPSS 0.00486 · Published 2024-09-10 · Partial fix · 4.20.0, 5.0.0 CWE-79
Priority LOW 21
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00665 · Published 2024-12-09 · Partial fix · 5.0.9, 3.3.8 CWE-835
THREATIST.IORead the docs