Red Hat Security AdvisoryRHSA-2025:8479
RHODF-4.16-RHEL-9 security update
Released 2025-06-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-rhel9-operator, odf4/ocs-client-console-rhel9 +4
Fixes 7 records
Priority HIGH 77
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.01034 · Published 2024-10-19 · Partial fix · 2.0.7, 3.0.3 CWE-400
Priority MEDIUM 40
golang-jwt is a Go implementation of JSON Web Tokens.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00811 · Published 2025-03-21 · Partial fix · 4.5.2, 5.2.2 CWE-405
Priority MEDIUM 40
body-parser is Node.js body parsing middleware.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00824 · Published 2024-09-10 · Partial fix · 1.20.3 CWE-405
Priority MEDIUM 40
Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00819 · Published 2024-07-01 · Partial fix CWE-1333
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01072 · Published 2024-12-18 · Partial fix · 0.33.0 CWE-1333
Priority LOW 29
Express.js minimalist web framework for node.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00786 · Published 2024-03-25 · Partial fix · 4.19.0, 5.0.0-beta.3 +1 CWE-1286
Priority LOW 27
A flaw was found in npm-serialize-javascript.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01122 · Published 2025-02-10 · Partial fix · 6.0.2, 4.4.8-2 +27 CWE-79
THREATIST.IORead the docs