| Requests vulnerable to .netrc credentials leak via malicious URLsCVE-2024-47081 · GHSA-9HJG-9R4M-MVJ7Version ranges need review. |
requestsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Tracing logging user input may result in poisoning logs with ANSI escape sequencesCVE-2025-58160 · GHSA-XWFJ-JGWM-7WP5Version ranges need review. |
tracing-subscriberConfidential Compute Attestation/build-of-trustee/trustee-rhel9 |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| Multiple issues involving quote API in shlexCVE-2024-58266 · GHSA-R7QV-8R2H-PG27Version ranges need review. |
shlexLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
Rust / CargoRed Hat |
Low
|
Fix reported |
|
| containerd CRI server: Host memory exhaustion through Attach goroutine leakCVE-2025-64329 · GHSA-M6HQ-P25P-FFR2Version ranges need review. |
github.com/containerd/containerd/v2github.com/containerd/containerd |
GoRed Hat |
Medium
|
Fix reported |
|
| js-yaml has prototype pollution in merge (<<)CVE-2025-64718 · GHSA-MH29-5H37-FV8M |
js-yamlCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Medium
|
Fix reported |
|
| filelock has a TOCTOU race condition which allows symlink attacks during lock file creationCVE-2025-68146 · GHSA-W853-JP5J-5J7FVersion ranges need review. |
filelockMigration Toolkit for Containers/rhmtc/openshift-migration-hook-runner-rhel8 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| node-forge is vulnerable to ASN.1 OID Integer TruncationCVE-2025-66030 · GHSA-65CH-62R8-G69G |
node-forgeCryostat 4/io.cryostat-cryostat |
npmRed Hat |
Medium
|
Fix reported |
|
| github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archivesCVE-2025-58058 · GHSA-JC7W-C686-C4V9Version ranges need review. |
github.com/ulikunitz/xzAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. |
pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Apache Commons Lang is vulnerable to Uncontrolled Recursion when processing long inputsCVE-2025-48924 · GHSA-J288-Q9X7-2F5V |
commons-lang:commons-langorg.apache.commons:commons-lang3 |
MavenRed Hat |
Medium
|
Fix reported |
|
| h2 allows HTTP Request Smuggling due to illegal characters in headersCVE-2025-57804 · GHSA-847F-9342-265HVersion ranges need review. |
h2OpenShift Service Mesh 3/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| urllib3 redirects are not disabled when retries are disabled on PoolManager instantiationCVE-2025-50181 · GHSA-PQ67-6M6Q-MJ2VVersion ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| protobuf-python has a potential Denial of Service issueCVE-2025-4565 · GHSA-8QVM-5X2C-J2W7Version ranges need review. |
protobufOpenShift Service Mesh 3/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| on-headers is vulnerable to http response header manipulationCVE-2025-7339 · GHSA-76C9-3JPH-RJ3Q |
on-headersCryostat 4/cryostat/cryostat-openshift-console-plugin-rhel9 |
npmRed Hat |
Low
|
Fix reported |
|
| CIRCL-Fourq: Missing and wrong validation can lead to incorrect resultsCVE-2025-8556 · GHSA-2X5J-VHC8-9CWMVersion ranges need review. |
github.com/cloudflare/circlBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-controller-rhel9 |
GoRed Hat |
Low
|
Fix reported |
|
| urllib3 does not control redirects in browsers and Node.jsCVE-2025-50182 · GHSA-48P4-8XCF-VXJ5Version ranges need review. |
urllib3Assisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Crash due to uncontrolled recursion in protobuf crateCVE-2025-53605 · GHSA-2GH3-RMM4-6RQ5Version ranges need review. |
protobufOpenShift Service Mesh 3/openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9 |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| `openssl` `X509VerifyParamRef::set_host` buffer over-readCVE-2023-53159 · GHSA-XCF7-RVMH-G6Q4Version ranges need review. |
opensslLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-operator-bundle |
Rust / CargoRed Hat |
Medium
|
Fix reported |
|
| Tornado vulnerable to Header Injection and XSS via reason argumentCVE-2025-67724 · GHSA-PR2V-JX2C-WG9FVersion ranges need review. |
tornadoExternal Secrets Operator for Red Hat OpenShift/external-secrets-operator/bitwarden-sdk-server-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| PyMdown Extensions has a ReDOS bug in its Figure Capture extensionCVE-2025-68142 · GHSA-R6H4-MM7H-8PMQVersion ranges need review. |
pymdown-extensionsAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-agent-rhel9 |
PyPIRed Hat |
Low
|
Fix reported |
|
