| Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSONCVE-2024-24786 · GHSA-8R3F-844C-MC37Version ranges need review. |
google.golang.org/protobuf/encoding/protojsongoogle.golang.org/protobuf/internal/encoding/json |
GoRed Hat |
Medium
|
Fix reported |
|
| Path traversal in webpack-dev-middlewareCVE-2024-29180 · GHSA-WR3J-PWJ9-HQQ6 |
webpack-dev-middlewareMigration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-console-plugin-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Potential memory exhaustion attack due to sparse slice deserializationCVE-2024-37298 · GHSA-3669-72X9-R9P3Version ranges need review. |
github.com/gorilla/schemaRed Hat Advanced Cluster Security 3/advanced-cluster-security/rhacs-central-db-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| ip SSRF improper categorization in isPublicCVE-2024-29415 · GHSA-2P57-RM9W-GVFP |
ipRed Hat Advanced Cluster Security 3/advanced-cluster-security/rhacs-central-db-rhel8 |
npmRed Hat |
High
|
No fix reported |
|
| github.com/containers/image allows unexpected authenticated registry accessesCVE-2024-3727 · GHSA-6WVF-F2VW-3425Version ranges need review. |
github.com/containers/image/v5github.com/containers/image |
GoRed Hat |
High
|
Fix reported |
|
| pgx SQL Injection via Line Comment CreationCVE-2024-27289 · GHSA-M7WR-2XF7-CM9PVersion ranges need review. |
github.com/jackc/pgx/v4github.com/jackc/pgx |
GoRed Hat |
High
|
Fix reported |
|
| Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)CVE-2024-28180 · GHSA-C5Q2-7R4C-MV6GVersion ranges need review. |
github.com/go-jose/go-jose/v3github.com/go-jose/go-jose/v4 |
GoRed Hat |
Medium
|
Fix reported |
|
| Express.js Open Redirect in malformed URLsCVE-2024-29041 · GHSA-RV95-896H-C2VC |
expressA-MQ Interconnect 1/qpid-dispatch |
npmRed Hat |
Medium
|
Fix reported |
|
| Denial of service while parsing a tar file due to lack of folders count validationCVE-2024-28863 · GHSA-F5X3-32G6-XQ36 |
node-tartar |
npmRed Hat |
Medium
|
Fix reported |
|
| follow-redirects' Proxy-Authorization header kept across hostsCVE-2024-28849 · GHSA-CXJH-PQWP-8MFP |
follow-redirectsCryostat 2/follow-redirects |
npmRed Hat |
Medium
|
Fix reported |
|
| NPM IP package incorrectly identifies some private IP addresses as publicCVE-2023-42282 · GHSA-78XJ-CGH5-2H22 |
ipNode HealthCheck Operator/workload-availability/node-remediation-console-rhel8 |
npmRed Hat |
Low
|
Fix reported |
|
| Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clientsCVE-2023-49569 · GHSA-449P-3H89-PW88Version ranges need review. |
github.com/go-git/go-git/v5gopkg.in/src-d/go-git.v4 |
GoRed Hat |
Critical
|
Fix reported |
|
| Follow Redirects improperly handles URLs in the url.parse() functionCVE-2023-26159 · GHSA-JCHW-25XP-JWWC |
follow-redirectsCryostat 2/follow-redirects |
npmRed Hat |
Medium
|
Fix reported |
|
| semver vulnerable to Regular Expression Denial of ServiceCVE-2022-25883 · GHSA-C2QF-RXJJ-QQGW |
semverMigration Toolkit for Applications 6/mta/mta-ui-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| Archiver Path Traversal vulnerabilityCVE-2024-0406 · GHSA-RHH4-RH7C-7R5VVersion ranges need review. |
github.com/mholt/archiver/v3github.com/mholt/archiver |
GoRed Hat |
Medium
|
No fix reported |
|
| Maliciously crafted Git server replies can cause DoS on go-git clientsCVE-2023-49568 · GHSA-MW99-9CHC-XW7RVersion ranges need review. |
github.com/go-git/go-git/v5gopkg.in/src-d/go-git.v4 |
GoRed Hat |
High
|
Fix reported |
|
| Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka TerrapinCVE-2023-48795 · GHSA-45X7-PX36-X8W8Version ranges need review. |
russhgolang.org/x/crypto |
Rust / CargoGoPyPIRed Hat |
Medium
|
Fix reported |
|
| Kubelet vulnerable to bypass of seccomp profile enforcementCVE-2023-2431 · GHSA-XC8M-28VV-4PJCVersion ranges need review. |
k8s.io/kubernetesOpenShift API for Data Protection/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Prototype Pollution in JSON5 via Parse MethodCVE-2022-46175 · GHSA-9C47-M6QQ-7P4H |
json5Migration Toolkit for Virtualization/migration-toolkit-virtualization/mtv-ui-rhel8 |
npmRed HatWordPress |
High
|
Fix reported |
|
| Supplementary groups are not set up properly in github.com/containerd/containerdCVE-2023-25173 · GHSA-HMFX-3PCX-653PVersion ranges need review. |
github.com/containerd/containerdCryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
