Red Hat Security AdvisoryRHSA-2025:8551
Red Hat OpenShift Data Foundation 4.14.18 Bug Fix Update
Released 2025-06-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- RHODF 4.14 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9 +1
Fixes 10 records
Priority HIGH 77
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00868 · Published 2024-11-08 · Partial fix · 6.0.6, 7.0.5 +1 CWE-1333
Priority HIGH 77
Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.01034 · Published 2024-10-19 · Partial fix · 2.0.7, 3.0.3 CWE-400
Priority HIGH 72
ws is an open source WebSocket client and server for Node.js.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01357 · Published 2024-06-17 · Partial fix · 5.2.4, 6.2.3 +2 CWE-476
Priority HIGH 66
Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01226 · Published 2024-03-21 · Partial fix · 7.1.0, 6.1.2 +1 CWE-22
Priority MEDIUM 51
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01151 · Published 2024-10-31 · Partial fix · 2.4.2 CWE-1321
Priority MEDIUM 40
body-parser is Node.js body parsing middleware.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00824 · Published 2024-09-10 · Partial fix · 1.20.3 CWE-405
Priority MEDIUM 40
Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00819 · Published 2024-07-01 · Partial fix CWE-1333
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01072 · Published 2024-12-18 · Partial fix · 0.33.0 CWE-1333
Priority LOW 29
Express.js minimalist web framework for node.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00786 · Published 2024-03-25 · Partial fix · 4.19.0, 5.0.0-beta.3 +1 CWE-1286
Priority LOW 27
A flaw was found in npm-serialize-javascript.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01122 · Published 2025-02-10 · Partial fix · 6.0.2, 4.4.8-2 +27 CWE-79
THREATIST.IORead the docs