DeutschShown in its original language — a full translation is planned for a future version.
Red Hat OpenShift: Mehrere Schwachstellen
view advisory published 2024-10-21
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren, vertrauliche Informationen preiszugeben, einen Cross-Site-Scripting-Angriff durchzuführen und beliebigen Code auszuführen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-45801US | medium6.1 | — | ||
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass th… | ||||
| CVE-2024-45590US | high7.5 | Exploit | ||
body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted pay… | ||||
| CVE-2024-43800US | medium4.7 | — | ||
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-sta… | ||||
| CVE-2024-43799US | medium4.7 | — | ||
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue i… | ||||
| CVE-2024-43796US | medium4.7 | — | ||
Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This… | ||||
| CVE-2024-45296US | — | — | ||
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Bec… | ||||
| CVE-2024-34158US | — | — | ||
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion. | ||||
| CVE-2024-34156US | — | — | ||
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635. | ||||
| CVE-2024-34155US | — | — | ||
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion. | ||||
| CVE-2024-43788US | medium6.1 | Exploit | ||
Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any re… | ||||
| CVE-2024-39338US | high7.5 | — | ||
axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs. | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2024:10186 vom 2024-11-22external
- Red Hat Security Advisory RHSA-2024:10762 vom 2024-12-03external
- Red Hat Security Advisory RHSA-2024:10857 vom 2024-12-05external
- Red Hat Security Advisory RHSA-2024:10865 vom 2024-12-05external
- Red Hat Security Advisory RHSA-2024:10895 vom 2024-12-11external
- Red Hat Security Advisory RHSA-2024:10906 vom 2024-12-10external
- Red Hat Security Advisory RHSA-2024:11023 vom 2024-12-12external
- Red Hat Security Advisory RHSA-2024:11293 vom 2024-12-17external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan