| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archivesCVE-2025-58058 · GHSA-JC7W-C686-C4V9Version ranges need review. |
github.com/ulikunitz/xzAssisted Installer for Red Hat OpenShift Container Platform 2/rhai/assisted-installer-controller-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| pip's fallback tar extraction doesn't check symbolic links point to extraction directoryCVE-2025-8869 · GHSA-4XH5-X5GV-QWPHVersion ranges need review. |
pipMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| golang.org/x/net vulnerable to Cross-site ScriptingCVE-2025-22872 · GHSA-VVGC-356P-C3XWVersion ranges need review. |
golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netCVE-2025-22870 · GHSA-QXP5-GWG8-XV66Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
Medium
|
Fix reported |
|
| Non-linear parsing of case-insensitive content in golang.org/x/net/htmlCVE-2024-45338 · GHSA-W32M-9786-JP63 |
golang.org/x/net/htmlgolang.org/x/net |
GoRed Hat |
High
|
Fix reported |
|
| github.com/containers/image allows unexpected authenticated registry accessesCVE-2024-3727 · GHSA-6WVF-F2VW-3425Version ranges need review. |
github.com/containers/image/v5github.com/containers/image |
GoRed Hat |
High
|
Fix reported |
|
| Denial of service while parsing a tar file due to lack of folders count validationCVE-2024-28863 · GHSA-F5X3-32G6-XQ36 |
node-tartar |
npmRed Hat |
Medium
|
Fix reported |
|
| Improper rendering of text nodes in golang.org/x/net/htmlCVE-2023-3978 · GHSA-2WRH-6PVC-2JM9Version ranges need review. |
golang.org/x/netOpenShift API for Data Protection/oadp/oadp-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Snakeyaml vulnerable to Stack overflow leading to denial of serviceCVE-2022-41854 · GHSA-W37G-RHQ8-7M4J |
org.yaml:snakeyamlA-MQ Clients 2/dev-java-snakeyaml |
MavenRed Hat |
Medium
|
Fix reported |
|
| Command Injection in pip when used with MercurialCVE-2023-5752 · GHSA-MQ26-G339-26XFVersion ranges need review. |
pipRed Hat Enterprise Linux 7/python-pip |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Uncontrolled Resource Consumption in Jackson-databindCVE-2022-42003 · GHSA-JJJH-JJXP-WPFF |
com.fasterxml.jackson.core:jackson-databindRed Hat Enterprise Linux 8/jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| Uncontrolled Resource Consumption in snakeyamlCVE-2022-25857 · GHSA-3MC7-4Q67-W48M |
org.yaml:snakeyamlA-MQ Clients 2/snakeyaml |
MavenRed Hat |
High
|
Fix reported |
|
| snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds WriteCVE-2022-38751 · GHSA-98WM-3W3Q-MW94 |
org.yaml:snakeyamlOpenShift Developer Tools and Services/jenkins-2-plugins |
MavenRed Hat |
Medium
|
Fix reported |
|
| snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds WriteCVE-2022-38750 · GHSA-HHHW-99GJ-P3C3 |
org.yaml:snakeyamlOpenShift Developer Tools and Services/jenkins-2-plugins |
MavenRed Hat |
Medium
|
Fix reported |
|
| snakeYAML before 1.31 vulnerable to Denial of Service due to Out-of-bounds WriteCVE-2022-38749 · GHSA-C4R9-R8FH-9VJ2 |
be.cylab:snakeyamlcom.alipay.sofa.acts:acts-common-util |
MavenRed Hat |
Medium
|
Fix reported |
|
| snakeYAML before 1.32 vulnerable to Denial of Service due to Out-of-bounds WriteCVE-2022-38752 · GHSA-9W3M-GQGF-C4P9 |
org.yaml:snakeyamlOpenShift Developer Tools and Services/jenkins-2-plugins |
MavenRed Hat |
Medium
|
Fix reported |
|
| setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File WriteCVE-2025-47273 · GHSA-5RJG-FVGR-3XXFVersion ranges need review. |
setuptoolsConfidential Compute Attestation/confidential-compute-attestation-tech-preview/trustee-rhel9 |
PyPIRed Hat |
High
|
Fix reported |
|
| Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipCVE-2024-24790 · GO-2024-2887 |
stdlibBuilds for Red Hat OpenShift/openshift-builds/openshift-builds-waiters-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mishandling of corrupt central directory record in archive/zipCVE-2024-24789 · GO-2024-2888 |
stdlibCustom Metric Autoscaler operator for Red Hat Openshift/custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
