Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Codeausführung

Summary

Product

Vulnerabilities 2

• Medium 5.6
  CVE-2021-23369 Public exploit

  Remote Code Execution (RCE)

  The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

  handlebars node-handlebars node-handlebars org.webjars:handlebars Debian Ubuntu npm Maven
  Apr 12, 2021
• Medium 5.6
  CVE-2021-23383 Public exploit

  Prototype Pollution

  The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

  handlebars node-handlebars node-handlebars Debian Ubuntu npm
  May 4, 2021

Revision history

1. 2022-12-19 #5

   Neue Updates von Tenable aufgenommen

2. 2022-10-09 #4

   Neue Updates von IBM aufgenommen

3. 2021-11-16 #3

   Neue Updates von Red Hat aufgenommen

4. 2021-08-05 #2

   Neue Updates von Red Hat aufgenommen

5. 2021-06-28 #1

   Initiale Fassung

References

• Tenable Security Advisory TNS-2022-28 vom 2022-12-19
  https://www.tenable.com/security/tns-2022-28
• Red Hat Customer Portal vom 2021-06-28
  https://access.redhat.com/errata/RHSA-2021:2500
• Red Hat Customer Portal vom 2021-06-28
  https://access.redhat.com/security/cve/CVE-2021-23369
• Red Hat Customer Portal vom 2021-06-28
  https://access.redhat.com/security/cve/CVE-2021-23383
• Red Hat Security Advisory RHSA-2021:3016 vom 2021-08-06
  https://access.redhat.com/errata/RHSA-2021:3016
• Red Hat Security Advisory RHSA-2021:4628 vom 2021-11-17
  https://access.redhat.com/errata/RHSA-2021:4628
• Red Hat Security Advisory RHSA-2021:4032 vom 2021-11-17
  https://access.redhat.com/errata/RHSA-2021:4032
• IBM Security Bulletin 6827893 vom 2022-10-08
  https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-may-affect-ibm-business-automation-workflow-cve-2018-25031-cve-2021-23369-cve-23383/