Red Hat OpenShift: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 11

• High 7.5
  CVE-2024-34156

  Stack exhaustion in Decoder.Decode in encoding/gob

  Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

  Go standard library encoding/gob katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• High 7.5
  CVE-2024-34158

  Stack exhaustion in Parse in go/build/constraint

  Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

  Go standard library go/build/constraint katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• High 7.5
  CVE-2024-45296

  path-to-regexp outputs backtracking regular expressions

  path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, …

  pillarjs path-to-regexp thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Azure Linux Wolfi npm
  Sep 9, 2024
• High 7.5
  CVE-2024-45590 Public exploit

  body-parser vulnerable to denial of service when url encoding is enabled

  body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denia…

  expressjs body-parser kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 10, 2024
• High 7.3
  CVE-2024-45801

  Tampering by prototype polution in DOMPurify

  DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to…

  cure53 DOMPurify argo-workflows dompurify Debian Ubuntu Wolfi npm
  Sep 16, 2024
• Medium 6.4
  CVE-2024-43788 Public exploit

  DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)

  Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulner…

  webpack webpack katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi npm
  Aug 27, 2024
• Medium 5.0
  CVE-2024-43796

  express vulnerable to XSS via response.redirect()

  Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

  expressjs express kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 10, 2024
• Medium 5.0
  CVE-2024-43799

  send vulnerable to template injection that can lead to XSS

  Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

  pillarjs send thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Azure Linux Wolfi npm
  Sep 10, 2024
• Medium 5.0
  CVE-2024-43800

  serve-static affected by template injection that can lead to XSS

  serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

  expressjs serve-static kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm
  Sep 10, 2024
• Medium 4.3
  CVE-2024-34155

  Stack exhaustion in all Parse functions in go/parser

  Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.

  Go standard library go/parser katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• Medium 4.0
  CVE-2024-39338

  Server-Side Request Forgery in axios

  axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

  kubeflow-pipelines-apiserver lerna kubeflow-centraldashboard jitsucom-jitsu-console Debian Ubuntu Wolfi npm
  Aug 9, 2024

Revision history

1. 2026-02-08 #29

   doppelte Eintragung bereinigt

2. 2026-02-05 #28

   Neue Updates von Red Hat aufgenommen

3. 2025-11-18 #27

   Neue Updates aufgenommen

4. 2025-06-04 #26

   Neue Updates von Red Hat aufgenommen

5. 2025-06-03 #25

   Neue Updates von Red Hat aufgenommen

6. 2025-05-20 #24

   Neue Updates von Red Hat aufgenommen

7. 2025-04-22 #23

   Neue Updates von Red Hat aufgenommen

8. 2025-02-04 #22

   Neue Updates von Red Hat aufgenommen

9. 2025-01-23 #21

   Neue Updates von Red Hat aufgenommen

10. 2025-01-14 #20

    Neue Updates von Red Hat aufgenommen

11. 2025-01-08 #19

    Neue Updates von Red Hat aufgenommen

12. 2025-01-07 #18

    Neue Updates von Red Hat aufgenommen

13. 2024-12-17 #17

    Neue Updates von Red Hat aufgenommen

14. 2024-12-12 #16

    Neue Updates von Red Hat aufgenommen

15. 2024-12-11 #15

    Neue Updates von Red Hat aufgenommen

16. 2024-12-09 #14

    Neue Updates von Red Hat aufgenommen

17. 2024-12-05 #13

    Neue Updates von Red Hat aufgenommen

18. 2024-12-03 #12

    Neue Updates von Red Hat aufgenommen

19. 2024-12-02 #11

    Neue Updates von Red Hat aufgenommen

20. 2024-11-21 #10

    Neue Updates von Red Hat aufgenommen

21. 2024-11-12 #9

    Neue Updates von Red Hat aufgenommen

22. 2024-11-10 #8

    Neue Updates von Red Hat aufgenommen

23. 2024-11-07 #7

    Neue Updates von Red Hat aufgenommen

24. 2024-11-06 #6

    Neue Updates von Red Hat aufgenommen

25. 2024-10-30 #5

    Neue Updates von Red Hat aufgenommen

References

• Red Hat Advisory vom 2024-10-21
  https://access.redhat.com/errata/RHSA-2024:8014
• Red Hat Security Advisory RHSA-2024:8229 vom 2024-10-23
  https://access.redhat.com/errata/RHSA-2024:8229
• Red Hat Security Advisory RHSA-2024:8232 vom 2024-10-23
  https://access.redhat.com/errata/RHSA-2024:8232
• Red Hat Security Advisory RHSA-2024:8260 vom 2024-10-24
  https://access.redhat.com/errata/RHSA-2024:8260
• Red Hat Security Advisory RHSA-2024:8263 vom 2024-10-24
  https://access.redhat.com/errata/RHSA-2024:8263
• Red Hat Security Advisory RHSA-2024:8581 vom 2024-10-29
  https://access.redhat.com/errata/RHSA-2024:8581
• Red Hat Security Advisory RHSA-2024:8676 vom 2024-10-30
  https://access.redhat.com/errata/RHSA-2024:8676
• Red Hat Security Advisory RHSA-2024:8425 vom 2024-10-31
  https://access.redhat.com/errata/RHSA-2024:8425
• Red Hat Security Advisory RHSA-2024:8337 vom 2024-10-31
  https://access.redhat.com/errata/RHSA-2024:8337
• Red Hat Security Advisory RHSA-2024:8677 vom 2024-10-30
  https://access.redhat.com/errata/RHSA-2024:8677
• Red Hat Security Advisory RHSA-2024:8428 vom 2024-10-31
  https://access.redhat.com/errata/RHSA-2024:8428
• Red Hat Security Advisory RHSA-2024:8692 vom 2024-11-07
  https://access.redhat.com/errata/RHSA-2024:8692
• Red Hat Security Advisory RHSA-2024:8688 vom 2024-11-06
  https://access.redhat.com/errata/RHSA-2024:8688
• Red Hat Security Advisory RHSA-2024:8697 vom 2024-11-07
  https://access.redhat.com/errata/RHSA-2024:8697
• Red Hat Security Advisory RHSA-2024:8700 vom 2024-11-08
  https://access.redhat.com/errata/RHSA-2024:8700
• Red Hat Security Advisory RHSA-2024:8981 vom 2024-11-13
  https://access.redhat.com/errata/RHSA-2024:8981
• Red Hat Security Advisory RHSA-2024:10186 vom 2024-11-22
  https://access.redhat.com/errata/RHSA-2024:10186
• Red Hat Security Advisory RHSA-2024:8704 vom 2024-12-02
  https://access.redhat.com/errata/RHSA-2024:8704
• Red Hat Security Advisory RHSA-2024:10762 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10762
• Red Hat Security Advisory RHSA-2024:10865 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10865
• Red Hat Security Advisory RHSA-2024:10857 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10857
• Red Hat Security Advisory RHSA-2024:10906 vom 2024-12-10
  https://access.redhat.com/errata/RHSA-2024:10906
• Red Hat Security Advisory RHSA-2024:10895 vom 2024-12-11
  https://access.redhat.com/errata/RHSA-2024:10895
• Red Hat Security Advisory RHSA-2024:11023 vom 2024-12-12
  https://access.redhat.com/errata/RHSA-2024:11023
• Red Hat Security Advisory RHSA-2024:11293 vom 2024-12-17
  https://access.redhat.com/errata/RHSA-2024:11293
• Red Hat Security Advisory RHSA-2025:0079 vom 2025-01-08
  https://access.redhat.com/errata/RHSA-2025:0079
• Red Hat Security Advisory RHSA-2025:0164 vom 2025-01-09
  https://access.redhat.com/errata/RHSA-2025:0164
• Red Hat Security Advisory RHSA-2025:0323 vom 2025-01-15
  https://access.redhat.com/errata/RHSA-2025:0323
• Red Hat Security Advisory RHSA-2025:0664 vom 2025-01-23
  https://access.redhat.com/errata/RHSA-2025:0664
• Red Hat Security Advisory RHSA-2025:0875 vom 2025-02-05
  https://access.redhat.com/errata/RHSA-2025:0875
• Red Hat Security Advisory RHSA-2025:4019 vom 2025-04-23
  https://access.redhat.com/errata/RHSA-2025:4019
• Red Hat Security Advisory RHSA-2025:8059 vom 2025-05-21
  https://access.redhat.com/errata/RHSA-2025:8059
• Red Hat Security Advisory RHSA-2025:8479 vom 2025-06-04
  https://access.redhat.com/errata/RHSA-2025:8479
• Red Hat Security Advisory RHSA-2025:8551 vom 2025-06-05
  https://access.redhat.com/errata/RHSA-2025:8551
• Atlassian Security Bulletin - November 18 2025
  https://confluence.atlassian.com/security/security-bulletin-november-18-2025-1671463469.html
• Red Hat Security Advisory RHSA-2026:2164 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2164
• Red Hat Security Advisory RHSA-2026:2172 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2172