Red Hat Security Advisory

RHSA-2025:14090

Red Hat Developer Hub 1.7.0 release.

Released 2025-08-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Fixes 9 records

TI-2025-05945 CVE-2025-6545 · GHSA-h7cp-r72f-jxh6

Improper input validation in pbkdf2

HIGH 72

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00447 Published 2025-06-23 Partial fix · 3.1.3 CWE-20

TI-2025-34225 CVE-2025-54419 · GHSA-4mxg-3p6v-xgq3

Node-SAML Contains SAML Signature Verification Vulnerability

MEDIUM 49

A SAML library not dependent on any frameworks that runs in Node.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00379 Published 2025-07-28 Fixed in 5.1.0 CWE-287

TI-2025-31125 CVE-2025-48997 · GHSA-g5hg-p3ph-g8qg

Multer vulnerable to Denial of Service via unhandled exception

MEDIUM 44

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00482 Published 2025-06-03 Partial fix · 2.0.1 CWE-248

TI-2025-30712 CVE-2025-48387 · GHSA-8cj5-5rvv-wf4v

tar-fs has issue where extract can write outside the specified dir with a specific tarball

MEDIUM 44

tar-fs provides filesystem bindings for tar-stream.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00579 Published 2025-06-02 Partial fix · 1.16.5, 2.1.3 +1 CWE-22

TI-2025-06690 CVE-2025-7338 · GHSA-fjgf-rc76-4x9p

Multer vulnerable to Denial of Service via unhandled exception from malformed request

MEDIUM 40

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00808 Published 2025-07-17 Partial fix · 2.0.2 CWE-248

TI-2025-04866 CVE-2025-5417 · GHSA-qxg3-p56f-vx54

Rhdh: red hat developer hub user permissions

LOW 29

An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image.

CVSS 3.1MEDIUM 6.1 Adjacent network High privileges No interaction EPSS 0.00222 Published 2025-08-19 Fixed in 1.7.0, sha256:aa3c5b50c65aee51b932fafcbf479ce54f15496cffc2744860bd9e135cce815c CWE-266

TI-2025-24005 CVE-2025-32997 · GHSA-9gqv-wp59-fq42

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

LOW 24

In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00472 Published 2025-04-15 Partial fix · 2.0.9, 3.0.5 CWE-754

TI-2025-24004 CVE-2025-32996 · GHSA-4www-5p9h-95mh

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.

LOW 24

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00466 Published 2025-04-15 Partial fix · 2.0.8, 3.0.4 CWE-670

TI-2025-16742 CVE-2025-22870 · GHSA-qxp5-gwg8-xv66

HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net

LOW 21

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component.

CVSS 3.1MEDIUM 4.4 Local Low privileges No interaction EPSS 0.00425 Published 2025-03-12 Partial fix · 1.23.7, 1.24.1 +1 CWE-115