Red Hat Security Advisory

RHSA-2025:22905

Red Hat OpenShift Pipelines Release 1.19.4

Released 2025-12-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Pipelines 1.19 registry.redhat.io/openshift-pipelines/pipelines-hub-api-rhel9, registry.redhat.io/openshift-pipelines/pipelines-hub-db-migration-rhel9, registry.redhat.io/openshift-pipelines/pipelines-hub-ui-rhel9

TI-2025-08513 CVE-2025-9288 · GHSA-95m3-7q98-8xr5

HIGH 72

Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00738 Published 2025-08-20 Partial fix · 2.4.12 CWE-20

TI-2025-08512 CVE-2025-9287 · GHSA-cpq7-6gpm-g9rc

HIGH 72

Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0055 Published 2025-08-20 Partial fix · 1.0.5 CWE-20

TI-2025-05947 CVE-2025-6547 · GHSA-v62p-rq8g-8h59

HIGH 72

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.This issue affects pbkdf2: <=3.1.2.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00463 Published 2025-06-23 Partial fix · 3.1.3 CWE-20

TI-2025-05945 CVE-2025-6545 · GHSA-h7cp-r72f-jxh6

HIGH 72

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00447 Published 2025-06-23 Partial fix · 3.1.3 CWE-20

TI-2025-40094 CVE-2025-64756 · GHSA-5j98-mcp5-4vw2

MEDIUM 40

Glob matches files using patterns the shell uses.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0309 Published 2025-11-17 Partial fix · 10.5.0, 11.1.0 CWE-78