| Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSONCVE-2024-24786 · GHSA-8R3F-844C-MC37Version ranges need review. |
google.golang.org/protobuf/encoding/protojsongoogle.golang.org/protobuf/internal/encoding/json |
GoRed Hat |
Medium
|
Fix reported |
|
| HTTP/2 rapid reset can cause excessive work in net/httpCVE-2023-39325 · GHSA-4374-P667-P6C8Version ranges need review. |
golang.org/x/netstdlib |
GoRed Hat |
High
|
Fix reported |
|
| github.com/containers/image allows unexpected authenticated registry accessesCVE-2024-3727 · GHSA-6WVF-F2VW-3425Version ranges need review. |
github.com/containers/image/v5github.com/containers/image |
GoRed Hat |
High
|
Fix reported |
|
| Improper rendering of text nodes in golang.org/x/net/htmlCVE-2023-3978 · GHSA-2WRH-6PVC-2JM9Version ranges need review. |
golang.org/x/netOpenShift API for Data Protection/oadp/oadp-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clientsCVE-2023-49569 · GHSA-449P-3H89-PW88Version ranges need review. |
github.com/go-git/go-git/v5gopkg.in/src-d/go-git.v4 |
GoRed Hat |
Critical
|
Fix reported |
|
| Archiver Path Traversal vulnerabilityCVE-2024-0406 · GHSA-RHH4-RH7C-7R5VVersion ranges need review. |
github.com/mholt/archiver/v3github.com/mholt/archiver |
GoRed Hat |
Medium
|
No fix reported |
|
| Maliciously crafted Git server replies can cause DoS on go-git clientsCVE-2023-49568 · GHSA-MW99-9CHC-XW7RVersion ranges need review. |
github.com/go-git/go-git/v5gopkg.in/src-d/go-git.v4 |
GoRed Hat |
High
|
Fix reported |
|
| Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka TerrapinCVE-2023-48795 · GHSA-45X7-PX36-X8W8Version ranges need review. |
russhgolang.org/x/crypto |
Rust / CargoGoPyPIRed Hat |
Medium
|
Fix reported |
|
| Kubelet vulnerable to bypass of seccomp profile enforcementCVE-2023-2431 · GHSA-XC8M-28VV-4PJCVersion ranges need review. |
k8s.io/kubernetesOpenShift API for Data Protection/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9 |
GoRed Hat |
Medium
|
Fix reported |
|
| Supplementary groups are not set up properly in github.com/containerd/containerdCVE-2023-25173 · GHSA-HMFX-3PCX-653PVersion ranges need review. |
github.com/containerd/containerdCryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| gosaml2 vulnerable to Denial Of Service Via Deflate Decompression BombCVE-2023-26483 · GHSA-6GC3-CRP7-25W5Version ranges need review. |
github.com/russellhaering/gosaml2Red Hat Advanced Cluster Security 3/advanced-cluster-security/rhacs-main-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| yaml package for Go can consume excessive amounts of CPU or memoryCVE-2022-3064 · GHSA-6Q6Q-88XP-6F2RVersion ranges need review. |
gopkg.in/yaml.v2Cryostat 2/cryostat-tech-preview/cryostat-rhel8-operator |
GoRed Hat |
High
|
Fix reported |
|
| x/crypto/ssh vulnerable to panic via malformed packetsCVE-2021-43565 · GHSA-GWC9-M7RH-J2WWVersion ranges need review. |
golang.org/x/cryptoMigration Toolkit for Containers/rhmtc/openshift-migration-velero-rhel8 |
GoRed Hat |
High
|
Fix reported |
|
| golang.org/x/crypto/ssh Denial of service via crafted SignerCVE-2022-27191 · GHSA-8C26-WMH5-6G9VVersion ranges need review. |
golang.org/x/cryptoMigration Toolkit for Containers/cpma |
GoRed Hat |
High
|
Fix reported |
|
| Mishandling of corrupt central directory record in archive/zipCVE-2024-24789 · GO-2024-2888 |
stdlibCustom Metric Autoscaler operator for Red Hat Openshift/custom-metrics-autoscaler-tech-preview/custom-metrics-autoscaler-rhel8-operator |
GoRed Hat |
Medium
|
Fix reported |
|
| Command Injection Vulnerability with Mercurial in VCSCVE-2022-21235 · GHSA-6635-C626-VJ4RVersion ranges need review. |
github.com/Masterminds/vcsOpenShift Serverless/openshift-serverless-1/ingress-rhel8-operator |
GoRed Hat |
Critical
|
Fix reported |
|
| Mattermost fails to limit the number of active sessionsCVE-2024-4183 · GHSA-WJ37-MPQ9-XRCMVersion ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mattermost crashes web clients via a malformed custom statusCVE-2024-4182 · GHSA-8F99-G2PJ-X8W3Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mattermost's detailed error messages reveal the full file pathCVE-2024-32046 · GHSA-VX97-8Q8Q-QGQ5Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Medium
|
Fix reported |
|
| Mattermost allows team admins to promote guests to team adminsCVE-2024-4195 · GHSA-5FH7-7MW7-MMX5Version ranges need review. |
github.com/mattermost/mattermost-serverRed Hat Advanced Cluster Management for Kubernetes 2/rhacm2/acm-grafana-rhel8 |
GoRed Hat |
Low
|
Fix reported |
|
