Red Hat OpenShift: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• Critical 10.0
  CVE-2024-47875 Public exploit

  DOMPurify nesting-based mXSS

  DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

  cure53 DOMPurify cacti argo-workflows Debian Ubuntu Wolfi npm
  Oct 11, 2024
• Critical 9.8
  CVE-2023-42282

  NPM IP package incorrectly identifies some private IP addresses as public

  The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

  renovate nodejs lerna sqlpad Debian Ubuntu Azure Linux Wolfi npm
  Feb 8, 2024
• Critical 9.8
  CVE-2024-21534 Public exploit

  JSONPath Plus Remote Code Execution (RCE) Vulnerability

  All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were severa…

  katib-suggestion-hyperopt katib-earlystopping katib-suggestion-pbt-enas katib-suggestion-hyperband Wolfi npm Maven
  Oct 11, 2024
• Critical 9.1
  CVE-2024-48949

  Elliptic's verify function omits uniqueness validation

  The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

  reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm
  Oct 10, 2024
• High 8.1
  CVE-2024-29415 Public exploit

  ip SSRF improper categorization in isPublic

  The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of …

  jupyter-base-notebook sqlpad pnpm-stage0 py3.10-jupyterlab Debian Ubuntu Wolfi npm
  May 27, 2024
• High 7.5
  CVE-2024-34156

  Stack exhaustion in Decoder.Decode in encoding/gob

  Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

  Go standard library encoding/gob katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• High 7.5
  CVE-2024-45296

  path-to-regexp outputs backtracking regular expressions

  path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, …

  pillarjs path-to-regexp thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Azure Linux Wolfi npm
  Sep 9, 2024
• Medium 5.3
  CVE-2024-45813

  ReDoS vulnerability in multiparametric routes in find-my-way

  find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single se…

  delvedor find-my-way find-my-way npm
  Sep 18, 2024

Revision history

1. 2026-02-05 #8

   Neue Updates von Red Hat aufgenommen

2. 2026-02-04 #7

   Neue Updates von Red Hat aufgenommen

3. 2025-11-18 #6

   Neue Updates aufgenommen

4. 2025-09-16 #5

   Referenz(en) aufgenommen: EUVD-2025-29356, EUVD-2025-29357

5. 2025-01-23 #4

   Neue Updates von Red Hat aufgenommen

6. 2024-12-17 #3

   Neue Updates von Red Hat aufgenommen

7. 2024-12-05 #2

   Neue Updates von Red Hat aufgenommen

8. 2024-11-25 #1

   Initiale Fassung

References

• Red Hat Security Advisory RHSA-2024:10236 vom 2024-11-25
  https://access.redhat.com/errata/RHSA-2024:10236
• Red Hat Security Advisory RHSA-2024:10857 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10857
• Red Hat Security Advisory RHSA-2024:10865 vom 2024-12-05
  https://access.redhat.com/errata/RHSA-2024:10865
• Red Hat Security Advisory RHSA-2024:11293 vom 2024-12-17
  https://access.redhat.com/errata/RHSA-2024:11293
• Red Hat Security Advisory RHSA-2025:0664 vom 2025-01-23
  https://access.redhat.com/errata/RHSA-2025:0664
• Atlassian Security Bulletin - November 18 2025
  https://confluence.atlassian.com/security/security-bulletin-november-18-2025-1671463469.html
• Red Hat Security Advisory RHSA-2026:1942 vom 2026-02-04
  https://access.redhat.com/errata/RHSA-2026:1942
• Red Hat Security Advisory RHSA-2026:2172 vom 2026-02-05
  https://access.redhat.com/errata/RHSA-2026:2172