| Jinja has a sandbox breakout through malicious filenamesCVE-2024-56201 · GHSA-GMJ6-6F8F-6699Version ranges need review. |
jinja2OpenShift Lightspeed/openshift-lightspeed-tech-preview/lightspeed-service-api-rhel9 |
PyPIRed Hat |
Medium
|
Fix reported |
|
| path-to-regexp contains a ReDoSCVE-2024-52798 · GHSA-RHX6-C78J-4Q9W |
path-to-regexpLogging Subsystem for Red Hat OpenShift/openshift-logging/kibana6-rhel8 |
npmRed Hat |
High
|
Fix reported |
|
| Kubernetes kubelet arbitrary command executionCVE-2024-10220 · GHSA-27WF-5967-98GXVersion ranges need review. |
k8s.io/kubernetesRed Hat Ansible Automation Platform 1.2/ansible-tower |
GoRed Hat |
High
|
Fix reported |
|
| Server-Side Request Forgery in axiosCVE-2024-39338 · GHSA-8HC4-VH64-CXMJ |
axiosMigration Toolkit for Runtimes/axios |
npmRed Hat |
High
|
Fix reported |
|
| urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirectsCVE-2024-37891 · GHSA-34JH-P97F-MPXFVersion ranges need review. |
urllib3Red Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filterCVE-2024-34064 · GHSA-H75V-3VVJ-5MFJVersion ranges need review. |
jinja2Red Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp vulnerable to Denial of Service when trying to parse malformed POST requestsCVE-2024-30251 · GHSA-5M98-QGG9-WH84Version ranges need review. |
aiohttpRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
High
|
Fix reported |
|
| aiohttp Cross-site Scripting vulnerability on index pages for static file handlingCVE-2024-27306 · GHSA-7GPW-8WMC-PM8GVersion ranges need review. |
aiohttpRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
Medium
|
Fix reported |
|
| social-auth-app-django affected by Improper Handling of Case SensitivityCVE-2024-32879 · GHSA-2GR8-3WC7-XHJ3Version ranges need review. |
social-auth-app-djangoRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
Medium
|
Fix reported |
|
| aiohttp is vulnerable to directory traversalCVE-2024-23334 · GHSA-5H86-8MV2-JQ9FVersion ranges need review. |
aiohttpRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
High
|
Fix reported |
|
| aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separatorsCVE-2024-23829 · GHSA-8QPW-XQXJ-H4R2Version ranges need review. |
aiohttpRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filterCVE-2024-22195 · GHSA-H5C8-RQWP-CP95Version ranges need review. |
jinja2Red Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Django allows enumeration of user e-mail addressesCVE-2024-45231 · GHSA-RRQC-C2JX-6JGVVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
Medium
|
Fix reported |
|
| Cross-site Scripting in djangorestframeworkCVE-2024-21520 · GHSA-GW84-84PC-XP82Version ranges need review. |
djangorestframeworkRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
Low
|
Fix reported |
|
| redis-py Race Condition vulnerabilityCVE-2023-28858 · GHSA-24WV-MV5M-XV4HVersion ranges need review. |
redisRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
Medium
|
Fix reported |
|
| redis-py Race Condition due to incomplete fixCVE-2023-28859 · GHSA-8FWW-64CX-X8P5Version ranges need review. |
redisRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
High
|
Fix reported |
|
| Django Path Traversal vulnerabilityCVE-2024-39330 · GHSA-9JMF-237G-QF46Version ranges need review. |
djangoRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
High
|
Fix reported |
|
| Django vulnerable to Denial of ServiceCVE-2024-39614 · GHSA-F6F8-9MX6-9MX2Version ranges need review. |
djangoRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
High
|
Fix reported |
|
| Django denial-of-service attack in the intcomma template filterCVE-2024-24680 · GHSA-XXJ9-F6RV-M3X4Version ranges need review. |
djangoRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
High
|
Fix reported |
|
| Django vulnerable to Denial of ServiceCVE-2024-38875 · GHSA-QG2P-9JWR-MMQFVersion ranges need review. |
djangoRed Hat Ansible Automation Platform 1.2/ansible-tower |
PyPIRed Hat |
High
|
Fix reported |
|
