Skip to content
OpenAdvisories
High WID-SEC-2026-0777 10 CVEs

Red Hat OpenShift: Mehrere Schwachstellen

Published Jul 1, 2020 · Updated Mar 18, 2026 · Revision 8 · de-DE

Vendor: IBM Vendor: Red Hat Vendor: SUSE Product: App Connect Enterprise Product: Enterprise Linux Product: Linux Product: openshift Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen Cross-Site-Scripting-Angriff durchzuführen, beliebigen Programmcode auszuführen, oder Auswirkungen hinsichtlich der Vertraulichkeit, Verfügbarkeit und Integrität zu verursachen.

Product

Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.

Vulnerabilities 10

  • High 8.2
    CVE-2020-7662

    Regular Expression Denial of Service in websocket-extensions (NPM package)

    websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequen…

    js-jquery websocket-extensions Azure Linux npm
  • High 8.1
    CVE-2020-7660

    Insecure serialization leading to RCE in serialize-javascript

    serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

    serialize-javascript npm
  • High 7.5
    CVE-2019-11253 Scanner template EPSS 26%

    Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack

    Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memo…

    Kubernetes Kubernetes kubernetes k8s.io/kubernetes Debian Alpine Go
  • Medium 4.2
    CVE-2019-16769

    Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)

    The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since N…

    yahoo serialize-javascript serialize-javascript npm
  • Unscored —
    CVE-2020-12052

    Grafana version < 6.7.3 is vulnerable for annotation popup XSS.

    grafana Ubuntu
  • Unscored —
    CVE-2020-12603

    Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests o…

  • Unscored —
    CVE-2020-12604

    Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 cl…

  • Unscored —
    CVE-2020-12605

    Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 header…

  • Unscored —
    CVE-2020-14306

    An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions th…

  • Unscored —
    CVE-2020-8663

    Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many conn…

Revision history

  1. #8

    Neue Updates von IBM aufgenommen

  2. #7

    Neue Updates von SUSE aufgenommen

  3. #6

    Neue Updates von SUSE aufgenommen

  4. #5

    Neue Updates von Red Hat aufgenommen

  5. #4

    Neue Updates von SUSE aufgenommen

  6. #3

    Neue Updates von SUSE aufgenommen

  7. #2

    Neue Updates von Red Hat aufgenommen

  8. #1

    Initiale Fassung

References