Red Hat Security AdvisoryRHSA-2025:0892
Red Hat OpenShift Dev Spaces 3.18.0 release
Released 2025-02-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel9, devspaces/dashboard-rhel9, devspaces/devspaces-rhel9-operator +1
Fixes 7 records
Priority HIGH 77
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00868 · Published 2024-11-08 · Partial fix · 6.0.6, 7.0.5 +1 CWE-1333
Priority HIGH 72
virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment.
CVSS 3.1HIGH 8.4· Local · No auth · No interaction · EPSS 0.01572 · Published 2024-11-24 · Partial fix · 20.26.6 CWE-78
Priority MEDIUM 53
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.03181 · Published 2024-12-11 · Partial fix · 0.31.0 CWE-285
Priority LOW 34
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
CVSS 3.1HIGH 7.3· Network · No auth · No interaction · EPSS 0.00894 · Published 2024-09-16 · Partial fix · 2.5.4, 3.1.3 CWE-1333
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01072 · Published 2024-12-18 · Partial fix · 0.33.0 CWE-1333
Priority LOW 32
An issue was discovered in PostCSS before 8.4.31.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00973 · Published 2023-09-29 · Partial fix · 8.4.31 CWE-74
Priority LOW 21
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00665 · Published 2024-12-09 · Partial fix · 5.0.9, 3.3.8 CWE-835
THREATIST.IORead the docs