Red Hat Security AdvisoryRHSA-2026:29795
OpenShift Container Platform 4.22.3 bug fix and security update
Released 2026-06-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift Container Platform 4.22 registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-csi-external-provisioner-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9
Fixes 5 records
Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02808 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-94
Priority MEDIUM 45
spdystream is a Go library for multiplexing streams over SPDY connections.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00656 · Published 2026-04-16 · Partial fix · 0.5.1 CWE-770
Priority MEDIUM 43
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00793 · Published 2026-05-22 · Partial fix · 1.8.4 CWE-77
Priority LOW 39
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00512 · Published 2026-05-05 · Partial fix · 3.1.2, 2.4.1 CWE-436
Priority LOW 36
protobufjs compiles protobuf definitions into JavaScript (JS) functions.
CVSS 4.0HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00407 · Published 2026-05-13 · Partial fix · 7.5.6, 8.0.2 CWE-94
THREATIST.IORead the docs