Skip to content
OpenAdvisories
Critical RHSA-2023:1486 5 CVEs

Red Hat Security Advisory: Red Hat Gluster Storage web-admin-build security update

Published Sep 30, 2024 · Updated Oct 13, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · Gluster Storage 3 storage:3.5:wa:el7 grafana 0:5.2.4-6.el7rhgs
Red Hat · Gluster Storage 3 storage:3.5:wa:el7 rubygem-puma 0:4.3.12-1.el7rhgs
Red Hat · Gluster Storage 3 storage:3.5:wa:el7 rubygem-puma-debuginfo 0:4.3.12-1.el7rhgs
Red Hat · Gluster Storage 3 storage:3.5:wa:el7 rubygem-puma-doc 0:4.3.12-1.el7rhgs
Red Hat · Gluster Storage 3 storage:3.5:wa:el7 rubygem-rack 0:2.2.4-1.el7rhgs
Red Hat · Gluster Storage 3 storage:3.5:wa:el7 rubygem-rack-doc 0:2.2.4-1.el7rhgs
Red Hat · Gluster Storage 3 storage:3.5:wa:el7 rubygem-tzinfo 0:1.2.10-1.el7rhgs
Red Hat · Gluster Storage 3 storage:3.5:wa:el7 rubygem-tzinfo-doc 0:1.2.10-1.el7rhgs

Vulnerabilities 5

  • Critical 10.0
    CVE-2022-30123

    Possible shell escape sequence injection vulnerability in Rack

    A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

    rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  • Critical 9.1
    CVE-2022-24790

    HTTP Request Smuggling in puma

    Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree o…

    puma puma puma puma Debian Ubuntu RubyGems
  • High 7.5
    CVE-2022-30122

    Denial of Service Vulnerability in Rack Multipart Parsing

    A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

    rack ruby-rack ruby-rack Debian Ubuntu RubyGems
  • High 7.5
    CVE-2022-31129

    Inefficient Regular Expression Complexity in moment

    moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…

    moment moment mediawiki wordpress Debian Ubuntu npm NuGet
  • High 7.5
    CVE-2022-31163

    TZInfo relative path traversal vulnerability allows loading of arbitrary files

    TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path…

    tzinfo tzinfo tzinfo ruby-tzinfo Debian Ubuntu RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2071616
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2099519
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2099524
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2105075
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2110551
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1486.json
  • report
    https://access.redhat.com/security/cve/CVE-2022-24790
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-24790
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-24790
  • report
    https://access.redhat.com/security/cve/CVE-2022-30122
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-30122
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-30122
  • article
    https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2022-30122.yml
  • report
    https://access.redhat.com/security/cve/CVE-2022-30123
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-30123
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-30123
  • advisory
    https://github.com/advisories/GHSA-wq4h-7r42-5hrr
  • report
    https://access.redhat.com/security/cve/CVE-2022-31129
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31129
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31129
  • article
    https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g
  • report
    https://access.redhat.com/security/cve/CVE-2022-31163
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2022-31163
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2022-31163
  • article
    https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx