Summary
[94.4-1.0.1]
- Switch to old frotend [Orabug: 38011073] [Orabug: 37856296] [Orabug: 37856375]
- Replaced additional upstream url [Orabug: 37856187]
- Replaced upstream urls in documentation with oracle links [Orabug: 37856187]
[94.4-1]
- New upstream release
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | cockpit-image-builder | 0:94.4-1.0.1.el10_2 |
Vulnerabilities 4
-
High 7.5
fast-uri vulnerable to server-side request forgery via repeated hostname percent-decoding
fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input int…
-
High 7.5
fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization
fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a diffe…
-
High 7.5
fast-uri vulnerable to host confusion via percent-encoded scheme normalization
fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an…
-
High 7.5
fast-uri vulnerable to authority injection via an unvalidated port in serialize
fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority de…