Skip to content
OpenAdvisories
High WID-SEC-2023-1295 2 CVEs

Red Hat OpenShift: Mehrere Schwachstellen

Published May 23, 2023 · Updated Jun 15, 2023 · Revision 2 · de-DE

Vendor: Red Hat Product: Enterprise Linux Product: OpenShift Data Foundation 4 Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.

Product

Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.

Vulnerabilities 2

  • High 7.5
    CVE-2022-24999 Public exploit EPSS 16%

    qs vulnerable to Prototype Pollution

    qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can pl…

    js-jquery nodejs-nodemon node-qs node-qs Debian Ubuntu Azure Linux npm
  • Medium 5.9
    CVE-2022-23539

    jsonwebtoken unrestricted key type could lead to legacy keys usage

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key …

    auth0 node-jsonwebtoken jsonwebtoken npm

Revision history

  1. #2

    Neue Updates von Red Hat aufgenommen

  2. #1

    Initiale Fassung

References