Security
فارسی
All products

Service Telemetry Framework 1.5/stf/service-telemetry-rhel9-operator

Red Hat · Package
10 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-49264 · GHSA-HJ66-6F7G-4R5VVersion ranges need review. oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 PyPIRed Hat Medium Fix reported
Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)CVE-2026-49265 · GHSA-XPV3-W29H-X7CVVersion ranges need review. oauthlibConfidential Compute Attestation/openshift-sandboxed-containers/osc-podvm-builder-rhel9 PyPIRed Hat Medium Fix reported
pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsCVE-2026-59884 · GHSA-M4P7-R5RC-7G4JVersion ranges need review. pyasn1Exploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 PyPIRed Hat High Fix reported
Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fixCVE-2026-45409 · GHSA-65PC-FJ4G-8RJXVersion ranges need review. idnaConfidential Cluster Operator/confidential-clusters-beta/attestation-key-register-rhel9 PyPIRed Hat Medium Fix reported
pip Vulnerable to Inclusion of Functionality from Untrusted Control SphereCVE-2026-6357 · GHSA-JP4C-XJXW-MGF9Version ranges need review. pipExploit Intelligence/exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 PyPIRed Hat Medium Fix reported
pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP filesCVE-2026-3219 · GHSA-58QW-9MGM-455VVersion ranges need review. pipLightspeed Core/lightspeed-core/lightspeed-stack-rhel9 PyPIRed Hat Medium Fix reported
Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility functionCVE-2026-25645 · GHSA-GC5V-M9X4-R6X2Version ranges need review. requestsExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 PyPIRed Hat Medium Fix reported
pip Path Traversal vulnerabilityCVE-2026-1703 · GHSA-6VGW-5PG2-W6JPVersion ranges need review. pipLightspeed Core/lightspeed-core/dataverse-exporter-rhel9 PyPIRed Hat Low Fix reported
pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 PyPIRed Hat Medium Fix reported
ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of CVE-2024-9902)CVE-2026-123037 Migration Toolkit for Applications 8/mta/mta-rhel9-operatorMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-rhel9-operator Red Hat Medium No fix reported