Red Hat Security Advisory

RHSA-2026:44263

OpenShift Container Platform 4.20.31 bug fix and security update

Released 2026-07-28 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-console-rhel9, registry.redhat.io/openshift4/ose-monitoring-plugin-rhel9 +1

TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw

HIGH 79

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00582 Published 2026-07-08 Partial fix · 7.5.19 CWE-770

TI-2026-10456 CVE-2026-12143 · GHSA-hmw2-7cc7-3qxx

HIGH 77

form-data is a library for creating readable multipart/form-data streams.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00669 Published 2026-06-12 Partial fix · 2.5.6, 3.0.5 +1 CWE-93

TI-2026-42684 CVE-2026-59869 · GHSA-52cp-r559-cp3m

HIGH 72

js-yaml is a JavaScript YAML parser and dumper.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00585 Published 2026-07-08 Partial fix · 3.15.0, 4.3.0 CWE-407

TI-2026-33473 CVE-2026-45736 · GHSA-58qx-3vcg-4xpx

HIGH 66

ws is an open source WebSocket client and server for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2026-05-15 Partial fix · 8.20.1 CWE-908

TI-2026-30642 CVE-2026-42338 · GHSA-v2v4-37r5-5v8g

MEDIUM 57

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00471 Published 2026-05-12 Partial fix · 10.1.1 CWE-79

TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p

MEDIUM 43

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00793 Published 2026-05-22 Partial fix · 1.8.4 CWE-77

TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm

MEDIUM 40

Prometheus is an open-source monitoring system and time series database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00813 Published 2026-05-04 Partial fix · 3.5.3, 3.11.3 +2 CWE-400

TI-2026-29551 CVE-2026-40895

LOW 31

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00486 Published 2026-04-21 Partial fix · 1.16.0 CWE-200