Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update

Fixed packages 4

Vulnerabilities 4

• Critical 9.1
  CVE-2019-10744 Public exploit

  Prototype Pollution in lodash

  Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

  snyk lodash js-jquery lodash Debian Azure Linux npm RubyGems
  Jul 25, 2019
• Medium 6.9
  CVE-2020-11022 Public exploit EPSS 99%

  jQuery has a potential XSS vulnerability

  In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

  jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems
  Apr 29, 2020
• Medium 5.6
  CVE-2020-7598 Public exploit

  Prototype Pollution in minimist

  minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

  js-jquery nodejs-nodemon minimist node-minimist Debian Ubuntu Azure Linux npm
  Mar 11, 2020
• Medium 5.5
  CVE-2020-12459

  Grafana world readable configuration files

  In certain Red Hat packages for Grafana 6.x through 6.3.6, the configuration files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml (which contain a secret_key and a bind_password) are world readable.

  github.com/grafana/grafana Go
  Apr 29, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1739497
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1813344
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1828406
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1829724
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2362.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10744
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10744
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10744
• report
  https://access.redhat.com/security/cve/CVE-2020-7598
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7598
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7598
• article
  https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
• report
  https://access.redhat.com/security/cve/CVE-2020-11022
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11022
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11022
• advisory
  https://github.com/advisories/GHSA-gxr4-xjj5-5px2
• report
  https://access.redhat.com/security/cve/CVE-2020-12459
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-12459
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-12459