DeutschShown in its original language — a full translation is planned for a future version.
Red Hat OpenShift: Mehrere Schwachstellen
view advisory published 2020-07-01
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen, einen Cross-Site-Scripting-Angriff durchzuführen, beliebigen Programmcode auszuführen, oder Auswirkungen hinsichtlich der Vertraulichkeit, Verfügbarkeit und Integrität zu verursachen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-14306US | high8.8OT elevated | — | ||
An incorrect access control flaw was found in the operator, openshift-service-mesh/istio-rhel8-operator all versions through 1.1.3. This flaw allows an attacker with a basic level… | ||||
| CVE-2020-8663US | high7.5 | — | ||
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may exhaust file descriptors and/or memory when accepting too many connections. | ||||
| CVE-2020-12605US | high7.5 | — | ||
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when processing HTTP/1.1 headers with long field names or requests with long URLs. | ||||
| CVE-2020-12604US | high7.5 | — | ||
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier is susceptible to increased memory usage in the case where an HTTP/2 client requests a large payload but does not send enough window… | ||||
| CVE-2020-12603US | high7.5 | — | ||
Envoy version 1.14.2, 1.13.2, 1.12.4 or earlier may consume excessive amounts of memory when proxying HTTP/2 requests or responses with many small (i.e. 1 byte) data frames. | ||||
| CVE-2020-7662US | high7.5 | — | ||
websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing… | ||||
| CVE-2020-7660US | high8.1 | — | ||
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". | ||||
| CVE-2020-12052US | medium6.1 | — | ||
Grafana version < 6.7.3 is vulnerable for annotation popup XSS. | ||||
| CVE-2019-16769US | medium5.4 | — | ||
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular… | ||||
| CVE-2019-11253US | high7.5 | — | ||
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious… | ||||
02
references
External citations — patches, advisories, analysis.
- SUSE Security Update SUSE-SU-2020:2876-1 vom 2020-10-07external
- SUSE Security Update SUSE-SU-2020:2911-1 vom 2020-10-13external
- Red Hat Security Adivisory:RHSA-2020:2795 vom 2020-07-01external
- Red Hat Security Adivisory:RHSA-2020:2796 vom 2020-07-01external
- Red Hat Security Adivisory:RHSA-2020:2798 vom 2020-07-01external
- Red Hat Security Advisory RHSA-2020:2861 vom 2020-07-07external
- Red Hat Security Advisory RHSA-2020:2863 vom 2020-07-07external
- Red Hat Security Advisory RHSA-2020:2864 vom 2020-07-07external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan