Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.3

Important

A flaw was found in nodejs-glob-parent. The enclosure regex used to check for glob enclosures containing backslashes is vulnerable to Regular Expression Denial of Service attacks. This flaw allows an attacker to cause a denial of service if they can supply a malicious string to the glob-parent function. The highest threat from this vulnerability is to system availability.

CWE-400 - Uncontrolled Resource Consumption

A flaw was found in nodejs-lodash. A Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions is possible.

CWE-400 - Uncontrolled Resource Consumption

A flaw was found in golang.org. In x/text, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension.

CWE-129 - Improper Validation of Array Index

A flaw was found in golang.org. In x/text, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag.

CWE-129 - Improper Validation of Array Index

A flaw was found in npm package ansi_up versions < 5.0.0 when parsing untrusted user input. An attacker could take advantage of this by introducing ANSI escape codes to inject arbitrary HTML and JavaScript in result mounting a cross-site scripting (XSS) attack.

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

A flaw was found in oras. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`.

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

An integer overflow was found in Redis. Redis 4.0 or newer uses a configurable limit for the maximum supported bulk input size. The default size is 512MB which is a safe value for all platforms. Authenticated Redis users could increase the bulk input size by changing the "proto-max-bulk-len" configuration parameter, leading to heap corruption and potentially remote code execution.

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

A flaw was found in fastify-reply-from. Escaping of the prefix of the proxied backend service is possible allowing an attacker, using a specially crafted URL, to gain access to directories that would otherwise be out of bounds. The highest threat from this vulnerability is to data confidentiality and integrity.

CWE-20 - Improper Input Validation