CVE-2023-27561

runc: volume mount race condition (regression of CVE-2019-19921)

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Debian Linuxfoundation Redhat

Products

Debian Linux Runc Enterprise Linux and 2 more

CVE-2024-28863

node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Isaacs Node-tar Project Redhat

Products

Tar Node-tar Enterprise Linux and 3 more

CVE-2024-29180

webpack-dev-middleware Path Traversal vulnerability

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory `memfs` filesystem. If `writeToDisk` configuration option is set to `true`, the physical filesystem is used. The `getFilenameFromUrl` method is used to parse URL and build the local file path. The public path prefix is stripped from the URL, and the `unsecaped` path suffix is appended to the `outputPath`. As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use `%2e` and `%2f` sequences to perform path traversal attack. Developers using `webpack-dev-server` or `webpack-dev-middleware` are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content. If the development server is listening on a public IP address (or `0.0.0.0`), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port). If the server allows access from third-party domains, an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files. Starting with fixed versions 7.1.0, 6.1.2, and 5.3.4, the URL is unescaped and normalized before any further processing.

CVSS 3.1 · 7.4 High EPSS 1.2% KEV · Not listed

Vendors

Redhat Webpack.js

Products

Advanced Cluster Security Apicurio Registry Jboss Data Grid and 8 more

CVE-2024-9453

Jenkins-image: sensitive data disclosure when using openshift jenkins image

A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are centralized when collected. The token is typically valid for one year. This flaw allows a malicious user to jeopardize the environment if they have access to sensitive information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Ocp Tools Openshift Developer Tools And Services

CVE-2024-28176

jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5.

CVSS 3.1 · 4.9 Medium EPSS 2.1% KEV · Not listed

Vendors

Fedoraproject Jose Project Redhat

Products

Fedora Jose Acm and 5 more

CVE-2024-28849

Proxy-Authorization header kept across hosts in follow-redirects

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Follow-redirects Project Redhat

Products

Follow-redirects Acm Advanced Cluster Security and 12 more

CVE-2024-28110

Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents. Prior to version 2.15.2, using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, then http.DefaultClient is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact. Version 2.15.2 patches this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cloudevents Redhat

Products

Go Sdk Sdk Go Openshift and 1 more

CVE-2024-28180

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

CVSS 3.1 · 4.3 Medium EPSS 2.0% KEV · Not listed

Vendors

Fedoraproject Go-jose Project Redhat

Products

Fedora Go-jose Acm and 12 more

CVE-2020-27827

lldp/openvswitch: denial of service via externally triggered memory leak

A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Fedoraproject Lldpd Project Openvswitch and 2 more

Products

Fedora Lldpd Openvswitch and 25 more

CVE-2024-34069

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.

CVSS 3.1 · 7.5 High EPSS 3.4% KEV · Not listed

Vendors

Debian Fedoraproject Palletsprojects and 1 more

Products

Debian Linux Fedora Werkzeug and 4 more

CVE-2019-11719

nss: Out-of-bounds read when importing curve25519 private key

When importing a curve25519 private key in PKCS#8format with leading 0x00 bytes, it is possible to trigger an out-of-bounds read in the Network Security Services (NSS) library. This could lead to information disclosure. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

CVSS 3.0 · 7.5 High EPSS 2.3% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 1 more

CVE-2024-48949

elliptic: Missing Validation in Elliptic's EDDSA Signature Verification

The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Indutny Redhat

Products

Elliptic Acm Multicluster Engine and 4 more

CVE-2024-7079

Openshift-console: unauthenticated installation of helm charts

A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2023-4066

Operator: passwords defined in secrets shown in statefulset yaml

A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Amq Broker Enterprise Linux Jboss A-mq and 3 more

CVE-2024-50311

Graphql: denial of service (dos) vulnerability via graphql batching

A denial of service (DoS) vulnerability was found in OpenShift. This flaw allows attackers to exploit the GraphQL batching functionality. The vulnerability arises when multiple queries can be sent within a single request, enabling an attacker to submit a request containing thousands of aliases in one query. This issue causes excessive resource consumption, leading to application unavailability for legitimate users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2023-4456

Openshift-logging: lokistack authorisation is cached too broadly

A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Logging Openshift Logging

CVE-2024-0406

Mholt/archiver: path traversal vulnerability

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mholt Redhat

Products

Archiver Advanced Cluster Security Openshift and 1 more

CVE-2023-5625

Python-eventlet: patch regression for cve-2021-21419 in some red hat builds

A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform For Arm64 and 6 more

CVE-2023-6476

Cri-o: pods are able to break out of resource confinement on cgroupv2

A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of service in the node.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform

CVE-2024-1725

Kubevirt-csi: persistentvolume allows access to hcp's root node

A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform Openshift Container Platform For Arm64 and 3 more