Red Hat Security AdvisoryRHSA-2025:8059
Red Hat OpenShift Data Foundation 4.17.7 Bug Fix Update
Released 2025-05-21 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHODF 4.17 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +8
Fixes 8 records
Priority HIGH 77
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.01034 · Published 2024-10-19 · Partial fix · 2.0.7, 3.0.3 CWE-400
Priority MEDIUM 40
golang-jwt is a Go implementation of JSON Web Tokens.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00811 · Published 2025-03-21 · Partial fix · 4.5.2, 5.2.2 CWE-405
Priority MEDIUM 40
body-parser is Node.js body parsing middleware.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00824 · Published 2024-09-10 · Partial fix · 1.20.3 CWE-405
Priority MEDIUM 40
Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00819 · Published 2024-07-01 · Partial fix CWE-1333
Priority LOW 35
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.
CVSS 4.0MEDIUM 6.6· Network · No auth · No interaction · EPSS 0.00399 · Published 2025-02-24 · Partial fix · 4.0.5, 3.0.4 CWE-770
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01072 · Published 2024-12-18 · Partial fix · 0.33.0 CWE-1333
Priority LOW 29
Express.js minimalist web framework for node.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00786 · Published 2024-03-25 · Partial fix · 4.19.0, 5.0.0-beta.3 +1 CWE-1286
Priority LOW 27
A flaw was found in npm-serialize-javascript.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01122 · Published 2025-02-10 · Partial fix · 6.0.2, 4.4.8-2 +27 CWE-79
THREATIST.IORead the docs