| Timing sidechannel for P-256 on ppc64le in crypto/internal/nistecCVE-2025-22866 · GO-2025-3447 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Kubelet vulnerable to bypass of seccomp profile enforcementCVE-2023-2431 · GHSA-XC8M-28VV-4PJCVersion ranges need review. |
k8s.io/kubernetesOpenShift API for Data Protection/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Supplementary groups are not set up properly in github.com/containerd/containerdCVE-2023-25173 · GHSA-HMFX-3PCX-653PVersion ranges need review. |
github.com/containerd/containerdCryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| goproxy Denial of Service vulnerabilityCVE-2023-37788 · GHSA-4R8X-2P26-976PVersion ranges need review. |
github.com/elazarl/goproxyLogging Subsystem for Red Hat OpenShift/openshift-logging/cluster-logging-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| HashiCorp Consul does not properly validate node or segment names prior to usage in JWT claim assertionsCVE-2021-41803 · GHSA-HR3V-8CP3-68RFVersion ranges need review. |
github.com/hashicorp/consulRed Hat OpenShift Container Platform 4/openshift4/ose-grafana |
GoRed Hat |
High
|
Fix reported |
|
| Command Injection Vulnerability with Mercurial in VCSCVE-2022-21235 · GHSA-6635-C626-VJ4RVersion ranges need review. |
github.com/Masterminds/vcsOpenShift Serverless/openshift-serverless-1/ingress-rhel8-operator |
GoRed Hat |
Critical
|
Fix reported |
|
| HashiCorp Vault Authentication bypassCVE-2020-16251 · GHSA-4MP7-2M29-GQXFVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| Hashicorp Nomad Information Exposure Through Environmental VariablesCVE-2019-14802 · GHSA-6HV3-7C34-4HX8Version ranges need review. |
github.com/hashicorp/nomadRed Hat OpenShift Container Platform 4/openshift4/topology-aware-lifecycle-manager-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault Incorrect Permission Assignment for Critical ResourceCVE-2021-43998 · GHSA-PFMW-VJ74-PH8GVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
Critical
|
Fix reported |
|
| Sensitive headers incorrectly sent after cross-domain redirect in net/httpCVE-2024-45336 · GO-2025-3420 |
stdlibAssisted Installer for Red Hat OpenShift Container Platform 2/rhai-tech-preview/assisted-installer-agent-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Helm vulnerable to information disclosure via getHostByName Function CVE-2023-25165 · GHSA-PWCW-6F5G-GXF8Version ranges need review. |
helm.sh/helm/v3Cryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault's PKI mount vulnerable to denial of serviceCVE-2023-0665 · GHSA-HWC3-3QH6-R4GGVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration FileCVE-2023-0620 · GHSA-V3HP-MCJ5-PG39Version ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacksCVE-2023-25000 · GHSA-VQ4H-9GHM-QMRRVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp VaultCVE-2020-16250 · GHSA-FP52-QW33-MFMWVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| HashiCorp Vault's revocation list not respectedCVE-2022-41316 · GHSA-9MH8-9J64-443FVersion ranges need review. |
github.com/hashicorp/vaultRed Hat OpenShift Container Platform 4/openshift4/topology-aware-lifecycle-manager-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault vulnerable to Cross-site ScriptingCVE-2023-2121 · GHSA-GQ98-53RQ-QR5HVersion ranges need review. |
github.com/hashicorp/vaultRed Hat OpenShift Container Platform 4/openshift4/ose-installer |
GoRed Hat |
Medium
|
Fix reported |
|
| Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy OperationCVE-2023-24999 · GHSA-WMG5-G953-QQFWVersion ranges need review. |
github.com/hashicorp/vaultRed Hat Openshift Container Storage 4/ocs4/cephcsi-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| xkeys seal encryption used fixed key for all encryptionCVE-2023-46129 · GHSA-MR45-RX8Q-WCM9Version ranges need review. |
github.com/nats-io/nats-server/v2github.com/nats-io/nkeys |
GoRed Hat |
High
|
Fix reported |
|
| Data Amplification in HashiCorp go-getterCVE-2023-0475 · GHSA-JPXJ-2JVG-6JV9Version ranges need review. |
github.com/hashicorp/go-getter/v2github.com/hashicorp/go-getter |
GoRed Hat |
Medium
|
Fix reported |
|
