Red Hat Security Advisory

RHSA-2025:3374

Red Hat Developer Hub 1.5.1 release.

Released 2025-03-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Developer Hub 1.5 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Fixes 11 records

TI-2025-21187 CVE-2025-29775 · GHSA-x3m8-899r-f7c3

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

HIGH 81

xml-crypto is an XML digital signature and encryption library for Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.10141 Published 2025-03-14 Partial fix · 6.0.1, 3.2.1 +1 CWE-347

TI-2025-21186 CVE-2025-29774 · GHSA-9p8x-f768-wp2g

xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

HIGH 81

xml-crypto is an XML digital signature and encryption library for Node.js.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.09103 Published 2025-03-14 Partial fix · 6.0.1, 3.2.1 +1 CWE-347

TI-2024-37295 CVE-2024-56334 · GHSA-cvv5-9h9w-qp2m

Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation

HIGH 69

systeminformation is a System and OS information library for node.js.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00699 Published 2024-12-20 Fixed in 5.23.7 CWE-94

TI-2025-16096 CVE-2025-22150 · GHSA-c76h-2ccp-4975

Undici Uses Insufficiently Random Values

HIGH 65

Undici is an HTTP/1.1 client.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00763 Published 2025-01-21 Partial fix · 5.28.5, 6.21.1 +1 CWE-330

TI-2024-31450 CVE-2024-47068 · GHSA-gcx4-mw62-g8wm

DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS

MEDIUM 60

Rollup is a module bundler for JavaScript.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00742 Published 2024-09-23 Partial fix · 3.29.5, 4.22.4 +1 CWE-79

TI-2024-35311 CVE-2024-52798 · GHSA-rhx6-c78j-4q9w

path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x

MEDIUM 41

path-to-regexp turns path strings into a regular expressions.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00787 Published 2024-12-05 Partial fix · 0.1.12 CWE-1333

TI-2024-30408 CVE-2024-45338 · GHSA-w32m-9786-jp63

Non-linear parsing of case-insensitive content in golang.org/x/net/html

LOW 32

An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01072 Published 2024-12-18 Partial fix · 0.33.0 CWE-1333

TI-2025-20348 CVE-2025-27516 · GHSA-cpwx-vrp4-4pq7

Jinja sandbox breakout through attr filter selecting format method

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00507 Published 2025-03-05 Partial fix · 3.1.6 CWE-1336

TI-2024-37287 CVE-2024-56326 · GHSA-q2x7-8rv6-6q7h

Jinja has a sandbox breakout through indirect reference to format method

LOW 27

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00522 Published 2024-12-23 Partial fix · 3.1.5 CWE-1336

TI-2024-37171 CVE-2024-56201 · GHSA-gmj6-6f8f-6699

Jinja has a sandbox breakout through malicious filenames

LOW 26

Jinja is an extensible templating engine.

CVSS 4.0MEDIUM 5.4 Local Low privileges User interaction EPSS 0.00307 Published 2024-12-23 Partial fix · 3.1.5 CWE-150

TI-2024-36887 CVE-2024-55565 · GHSA-mwcw-c2x4-8c55

nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.

LOW 21

nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00665 Published 2024-12-09 Partial fix · 5.0.9, 3.3.8 CWE-835