Medium WID-SEC-2024-2035 5 CVEs

Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Manipulation von Dateien und Denial of Service

Published Sep 3, 2024 · Updated Nov 12, 2024 · Revision 7 · de-DE

Vendor: Red Hat Product: Enterprise Linux Product: openshift

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Dateien zu manipulieren und um einen Denial of Service zu verursachen.

Product

Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.

Vulnerabilities 5

Medium 5.3

CVE-2024-42459

Elliptic's EDDSA missing signature length check

In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus zero-valued bytes can be removed or appended.

reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm

Aug 2, 2024
Medium 5.3

CVE-2024-42460

Elliptic's ECDSA missing check for whether leading bit of r and s is zero

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit of r and s is zero.

reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm

Aug 2, 2024
Medium 5.3

CVE-2024-42461 Public exploit

Elliptic allows BER-encoded signatures

In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.

reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm

Aug 2, 2024
Medium 4.3

CVE-2024-28180

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…

go-jose go-jose zot kubescape Debian Azure Linux Alpine Wolfi Go

Mar 9, 2024
Medium 4.0

CVE-2024-39338

Server-Side Request Forgery in axios

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

kubeflow-pipelines-apiserver lerna kubeflow-centraldashboard jitsucom-jitsu-console Debian Ubuntu Wolfi npm

Aug 9, 2024

Revision history

2024-11-12 #7
Neue Updates von Red Hat aufgenommen
2024-10-23 #6
Neue Updates von Red Hat aufgenommen
2024-10-07 #5
Neue Updates von Red Hat aufgenommen
2024-09-18 #4
Neue Updates von Red Hat aufgenommen
2024-09-17 #3
Neue Updates von Red Hat aufgenommen
2024-09-12 #2
Neue Updates von Red Hat aufgenommen
2024-09-03 #1
Initiale Fassung

References

RedHat Security Advisory vom 2024-09-03
https://access.redhat.com/errata/RHSA-2024:6209
Red Hat Security Advisory RHSA-2024:6210 vom 2024-09-03
https://rhn.redhat.com/errata/RHSA-2024:6210.html
Red Hat Security Advisory RHSA-2024:6667 vom 2024-09-13
https://access.redhat.com/errata/RHSA-2024:6667
Red Hat Security Advisory RHSA-2024:6738 vom 2024-09-17
https://access.redhat.com/errata/RHSA-2024:6738
Red Hat Security Advisory RHSA-2024:6779 vom 2024-09-18
https://access.redhat.com/errata/RHSA-2024:6779
Red Hat Security Advisory RHSA-2024:7759 vom 2024-10-07
https://access.redhat.com/errata/RHSA-2024:7759
Red Hat Security Advisory RHSA-2024:8260 vom 2024-10-24
https://access.redhat.com/errata/RHSA-2024:8260
Red Hat Security Advisory RHSA-2024:8981 vom 2024-11-13
https://access.redhat.com/errata/RHSA-2024:8981