RHSA-2026:40984
Vulnerability from csaf_redhat - Published: 2026-07-16 11:26 - Updated: 2026-09-20 06:05A flaw was found in node-forge. This vulnerability allows unauthenticated attackers to bypass downstream cryptographic verifications and security decisions via crafting ASN.1 (Abstract Syntax Notation One) structures to desynchronize schema validations, yielding a semantic divergence.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:330cae7d058b96317b8491b53d5dae3fb6375a47b5744b30c9df116b029aa664_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:668dfe581c71024f3df2be60109cdb325190d7cd4d861e5fc3dfb6bd01dad986_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:811fb7e18f3ad662751bd217764ccbd3f551ad64eee318d6c56391f94d5fecf6_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/cephcsi-rhel9-operator@sha256:d2ef0fbc8fdbc8053b55cd9945985e30cdba8f3d1db56d67b0b2fa0b1af12d27_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/cephcsi-rhel9@sha256:7d0ee8cf249dafabae40686c0a388721d9e57d704402a86551d247c8d8879f77_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/cephcsi-rhel9@sha256:940cd4bc97f6ef3620baa0ebca7beee947c34be9355beabd68a32df3bb951087_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/cephcsi-rhel9@sha256:d1d9ee046d756cb57e3a56589ee4682b2c14a1419ee8f3a7a6c287244caf8b2c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/cephcsi-rhel9@sha256:ffd512657b2587866bdd42012599027977206f8a1a11ea1119c1349e646d2ddf_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/mcg-core-rhel9@sha256:166209cf6aba8304d21e726b01e8daa23ba9c55d101965af7361028502202d12_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/mcg-core-rhel9@sha256:6e43cd07cd09a8ffbc0d93d231d700f13fdef16214d37c7a08e61ebb0705f894_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/mcg-core-rhel9@sha256:b61fbea3a0cd949c2cfe81ede0ef258cc5b9e40be586c5b9c8683661e3fd4cbf_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/mcg-core-rhel9@sha256:ca371cc6a86d0f550ed81f50617dec89a96d6f937df6e3aef5b901065577f05e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/mcg-rhel9-operator@sha256:0c1b66f5de4228ed4126a9539f0396d2cc66969ef681f627028216014dfaad62_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/mcg-rhel9-operator@sha256:37088cfa9eb040c313aeda47ebf25cdd6da56e8a590a9138ca733058c0cd4f89_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/mcg-rhel9-operator@sha256:5e69d78a4bd6d1a2dbef5a67dfb37a12a63b20d4eee8f0996053d69c6ed32783_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/mcg-rhel9-operator@sha256:cf2ddab5cce4e1745af69d57cfe7a30ed7d679535fdaec820c3e7e42ee6b4f21_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:29f2259cdd8f0c1816c00132494f18b8bb35242e7a66be8939423d3736fb2eea_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:5745226a94969b986e5506d7ad87c3fe1c1f19b6bdb9e2793d1481c0110abac7_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:8db8b9f10bca358b10656a71aa6daab9b393e298da7bba612248ce44f5e01058_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-client-console-rhel9@sha256:e068dee56a84a243982c14067354234d7440283c2c77284ddc1cc47ac0e4d4dd_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:2950615bac6bd9cf88f38e60d014edfb2e619aeff84b10e6f5756cdf74848deb_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:628546741792632dd843a88eec8ef184166a4a11ca5b852fdc5211ea4c5ddcf0_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:754f8f8710fdaa7d4235ae202ad84f351b554d8f208056b5f13248f330ea56e5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-client-rhel9-operator@sha256:ad85aa77d1ef3243872eab3830ddd48d6d734b3db3a9eec84ba8488148e3e71d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:55bf353d6b4c47fe8fb265cfdb7b5305901d1c5165e9ce19d1b90b0168802fac_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:5d566c013690784aff986517cbe99c91724e9323b67f47144aa9ccf90750cc84_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:92ccfa2474af6dbb9f151200354ea4deb89fa9834f65197de6efbefb88978c2e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-metrics-exporter-rhel9@sha256:dd5ce2895124aaa41713390bfdcda3ce1a2d4c0281408c3c4c3704a580cf248d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-rhel9-operator@sha256:107536a3ea86764a82b053cdb5a1d496862c94e6770cdba28d88217c8eba4aa8_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-rhel9-operator@sha256:657da581a13815727c2e94577f8664c5ec22ad52a424394761ccdf9ffac26096_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-rhel9-operator@sha256:afa2835b21e4cae9c17435bb108a93dd8397a7ef4721b177f4790b7513e26141_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-rhel9-operator@sha256:b0827b1d737226b230b1c82f580591d878d72af06bd0ee0ee8d5f3211b91cfe5_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cli-rhel9@sha256:07a7b2b9a30cd03aef3807e21fbe9ee5397f68b4da982ea798d8a4c34cb6d829_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cli-rhel9@sha256:3630a5c480cb00b3e0343ae434ca8bfe6447be53d7cd56c2902d831ce8d4a093_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cli-rhel9@sha256:6c6e2079444f21f140e990a50dceb186d59078d9f0b1f275ac6b7e6bce7b0718_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cli-rhel9@sha256:e6d4d68bd44ac64320f3e558af6f747da5c9fb8d0b9933adfd76e5e461129d46_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:03636a4e659c38b0d0944d8be9a1584fbf19d87b277d7eca34598c2f81a10cc9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:39231a05f80980b0a41ebe46768efd333df1e50ba24e11f191a199a9c6314a90_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:69da5ea2e8ff92d7cbe71ad531728cbe0c30b3826d3fd31f162fd8f76c496e23_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cloudnative-pg-rhel9-operator@sha256:9e6198c0e0bfd26e9431ca7c0f89122ff2c440994360928a7f4ddc883b2643b9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-console-rhel9@sha256:5d48a8570af85bd000ffd009a8a14f76a63d5c67820bfae49da0017fbc7d0442_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-console-rhel9@sha256:762280b4a2461eb8f74edec671189549a2a081c5c80e109510ec9dcffe343e35_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-console-rhel9@sha256:c0bc9569d493470285397cceb42487a0a69f956b5bf29ab05147bed1ee73e9a0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-console-rhel9@sha256:d8307264ad60c670a95fb3d1786f3e4931daa9ce1f0b37d1ee88fe7b9f13a442_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:225b66c0fc3f90e9d2ad3c0256f28e9efbaad6406d1f95495118e14d2e1e4c81_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:2f52932f9e0b36925648fb44208f60039a8a9044d516675e36f831cbcc3e33ad_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:341a23d03fbb1185783b9a208f19a878de6aa7f3a06374e814e8225de976b5d7_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-cosi-sidecar-rhel9@sha256:359026fa10401ecff8ac805866bc4653d8e2078fdcdb15272b727ee7d3ec59ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:08dfd5910f83132e5a941696997831696b05f71de113376e5c7dceda981e070d_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:3040c3f2b7136c74ded0a355851f5ffabe771b8892bd0a20c9e5ee248dc9e224_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:41b64d69a9b2435fff4192543c877b0b9fe449b682b006a0bd58bbd348f9e0be_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-csi-addons-rhel9-operator@sha256:74b9066762ac94106aace909f6d39205476cb51d3c2c9f2dafdbf9072c0cf13d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:72ae15e2e9774cafee010726285c5396d01383617ce8a872d3f7a6e618d39d70_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:87aab3b5b5074503713ec700da8272bb8b9bd1ff01b927acba22b706cc579128_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:a742cc0c5561b0904c99426fa69d67b4058e78c0909365765c4238a0d9446d50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-csi-addons-sidecar-rhel9@sha256:fbde5909d4ff0c9804ed4342e3828021fa404d4ed49da36f5c8a83bddfed856c_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:38af85e11e33248d7fb22028e5bbb14892fc6c9c106cbce3507587010cfa0a61_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:6ba7ddc6a4b8523366ac8d17c9b7506c76fa290b08192709607fa4f709a37149_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:9fb9f5064f1cc36952c6688b4126fb2034c34d0ccfdd346038ec73c8dfcc2a9e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-external-snapshotter-rhel9-operator@sha256:b7b87c91d1ca506411a49935884ec894f079fec473306d92344d88133265a0d9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:0054ea99c762956a92a8340e0bb27176f0cce5464c9d66b2518aa457e7397a5f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:601c24feed09e144e2c5198f5e0dadb70af1faa05309ec5eebb6f9b4c125e839_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:93b6ac7c591fdf4fc35fabd4f0caf76b2bc5fe5ccd7ad52eeee4d9bd84b553e9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-external-snapshotter-sidecar-rhel9@sha256:bb2d553dcd006a65fa791090e1a0e415792522ce875ddea18b5a009dfb082bb3_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:1c89dc12373601f7c34b6a61ba1779a00b67619dcdaa22f4829452b7281838b4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:4e67f964fb45e8d018ee16f52a6d55a4a7dee3c81c63360490b34fbb2fcb11a7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:5094c11d3080c3f9687a28a355e10891bd132337dce6abffa96ae9bb337fd30f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-multicluster-console-rhel9@sha256:ca3a42affe38e6302694e97fe9111d4d4ca5d07a09ec45bbdb4c80e09871a7e9_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-multicluster-rhel9-operator@sha256:58c688dd3b40d6fccac334dc5475be6ca812b2729ba8567429312a400af9077d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-multicluster-rhel9-operator@sha256:9b328073e0e7f608ca11485e7da2a224a5a577cf94b028642d9edbfd750a3092_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-multicluster-rhel9-operator@sha256:af14a03f06bd4c89c43add8dd3ee82f717120efa71c8c95fb8ff06f041406a9b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-multicluster-rhel9-operator@sha256:e402db6739683d105f17bfb5216bbf1e5824d56693d95d1cd546770e1651604c_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:4c6c43a80673283b24211582b4ef76217c412029b3a61835e2189cb92bf63f38_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:7f57f1642796ec1dc3c144a4687d3b7dfb9eba638971a494a539c5e86e874500_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:7f7bf1180b1fb2f67e8e86b999930c86cf5a8fdec4940272b223498ca25f8816_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-must-gather-rhel9@sha256:baf980c297fb2b4348eb99cd2ea8f05d5cfe2429e7f03f0bca68f2153f9fadc3_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-rhel9-operator@sha256:5e682039d563344be28d3fc4aa703c8bb42b2006942dee28710ceaa79417fef6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-rhel9-operator@sha256:d9dab6dd42f7bf78c529d68c3c01931faf6df1f9e1635934c1a1a3e9ae70a1f0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-rhel9-operator@sha256:df9b2ab8c0af7790cb37b51fd4defd579d999253613812e701ed3c80769d4c57_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-rhel9-operator@sha256:f7e593b3cf3574b68116d7c665263cde49484aad09a237a9f5739b28adc5802f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odr-rhel9-operator@sha256:331a05e10583a02a546edf60e6da2a2e22278594fb70d6c1713aa16d16029850_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odr-rhel9-operator@sha256:95d6257bf2daf02666103c7f15febd86e9aa61ccb700c616d2eca0ae0e1b2fae_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odr-rhel9-operator@sha256:dd062af860d669958ced4edaa47ff8e17067a34089a003ab6ac2a9c61ec4224f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odr-rhel9-operator@sha256:e2c6e98fa4ba8eb59c76c5a62f544a332da2a1e81ce95094bb3df7acf4fbb3d9_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:35da53ac959ab8e6f1cc04aad03869f2f614b8eb86ccad7484f4c3d24d9899ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:7bf1cd386b3a4e5c4d0417770b724146face0929a397c79e43f2b7494c94ae29_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:89adf65f90b6eda141e8f7ee1c3d298b230d4fa6a139112398d7aeefb7924f89_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/rook-ceph-rhel9-operator@sha256:a54e1ffeddc2efd1ed5479505b309659ee57dda37b2498f984c30ec15d1366e0_arm64 | — |
Vendor Fix
fix
Workaround
|
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/cephcsi-operator-bundle@sha256:522d40e50ef3d69227addc4eb2d21110da67a71ab38a392a6a73de196e291ea5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/mcg-operator-bundle@sha256:e4a75de357d5dbea6ec922e69d6655c6ce4bc7ed8d5109c867004b6b7d80b326_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-client-operator-bundle@sha256:55f4e42887bb170300981c39073628c0fed7e396fcb149a7b57fe6e7254cea02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/ocs-operator-bundle@sha256:d24d8b73eab3f7be9d62b1e3fece5a8eac5bf306e9366aaa08bb47c7e8add71e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-csi-addons-operator-bundle@sha256:30b284e612c4440793c445513ac7e488b5dd67ca0645366ed1b8249aa3317e01_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-dependencies-operator-bundle@sha256:e5db02deda355eb82187072f156c5bb469843e134133993f587dcf86c7f82bd2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-external-snapshotter-operator-bundle@sha256:d726054bb579afb099b2a2515d3624cef3e42c3af548c9b363db573551f8aa8f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-multicluster-operator-bundle@sha256:d3ed72b25b5390eba296876bd2629f8f56eb97963131f080e7fc32f448a96a19_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-operator-bundle@sha256:73f325e7068c745656acbc8f5b6e2a0e8d23b6e47bcd128ebd8a79b9f75af84b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odf-prometheus-operator-bundle@sha256:40d8e2ca1434e17fa6e5a9b3df28e652822908aae51f6e6ff405836e2269b504_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odr-cluster-operator-bundle@sha256:b81cd403cb4d165c8ad5adb5cfdb6fd583104dc929b245bfd1eeb78af1776505_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odr-hub-operator-bundle@sha256:b454a2aecf238329a1c28fa978e3003917ac28fbf24d06c5724696be8d2ab1aa_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/odr-recipe-operator-bundle@sha256:2300184bfeb526a402eceb6582794d84bc949b4963de8a503ee308de19969985_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Openshift Data Foundation 4.20:registry.redhat.io/odf4/rook-ceph-operator-bundle@sha256:06d46cfc28ce9af241436a93f653a3e7fe894a363b71890b67931b42ed06f657_amd64 | — |
Workaround
|
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.
An ASN.1 Denial of Service (Dos) vulnerability exists in the node-forge asn1.fromDer function within forge/lib/asn1.js. The ASN.1 DER parser implementation (_fromDer) recurses for every constructed ASN.1 value (SEQUENCE, SET, etc.) and lacks a guard limiting recursion depth. An attacker can craft a small DER blob containing a very large nesting depth of constructed TLVs which causes the Node.js V8 engine to exhaust its call stack and throw RangeError: Maximum call stack size exceeded, crashing or incapacitating the process handling the parse. This is a remote, low-cost Denial-of-Service against applications that parse untrusted ASN.1 objects.
An SSRF flaw has been discovered in Webpack. When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces allowedUris only for the initial URL, but does not re-validate allowedUris after following HTTP 30x redirects. As a result, an import that appears restricted to a trusted allow-list can be redirected to HTTP(S) URLs outside the allow-list. This is a policy/allow-list bypass that enables build-time SSRF behavior (requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion in build outputs (redirected content is treated as module source and bundled).
CWE-918 - Server-Side Request Forgery (SSRF)An SSRF flaw has been discovered in Webpack. When experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be bypassed to fetch resources from hosts outside allowedUris by using crafted URLs that include userinfo (username:password@host). If allowedUris enforcement relies on a raw string prefix check (e.g., uri.startsWith(allowed)), a URL that looks allow-listed can pass validation while the actual network request is sent to a different authority/host after URL parsing. This is a policy/allow-list bypass that enables build-time SSRF behavior (outbound requests from the build machine to internal-only endpoints, depending on network access) and untrusted content inclusion (the fetched response is treated as module source and bundled).
CWE-918 - Server-Side Request Forgery (SSRF)A flaw was found in ajv. When the $data option is enabled, the value of the pattern keyword is passed directly to the JavaScript RegExp() constructor without sufficient validation. An attacker able to supply a malicious regular expression pattern can trigger a ReDoS (Regular Expression Denial of Service), causing the application to become unresponsive and resulting in a denial of service.
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
A cross site scripting flaw has been discovered in the npm react-router and @remix-run/router packages. React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unstable RSC modes can result in unsafe URLs causing unintended javascript execution on the client. This is only an issue if you are creating redirect paths from untrusted content or via an open redirect.
A denial of service flaw has been discovered in the fast-xml-parser npm library. In fast-xml-parser, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `�` or `�`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.
A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted XML input. The system incorrectly interprets a dot in a DOCTYPE entity name as a regular expression wildcard during processing. This allows the attacker to bypass security measures and inject malicious scripts, resulting in Cross-Site Scripting (XSS) when the parsed output is displayed to users.
A denial of service flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by providing a specially crafted, small XML input. This input can force the XML parser to perform an unlimited amount of entity expansion, consuming excessive resources. This can lead to the application freezing for an extended period, resulting in a Denial of Service (DoS).
A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.
A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).
A flaw was found in fast-xml-parser. A user can exploit this flaw by processing specially crafted XML data with the XML builder when the `preserveOrder` option is enabled. This can lead to a stack overflow, causing the application to crash and resulting in a Denial of Service (DoS).
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
A flaw was found in fast-xml-parser. A remote attacker can exploit this vulnerability by supplying specially crafted XML input containing numeric character references or standard XML entities. This input can bypass configured entity expansion limits, leading to excessive memory allocation and high CPU usage. The primary consequence is a Denial of Service (DoS), which can crash the affected process.
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability.
A flaw was found in github.com/jackc/pgx, a PostgreSQL driver for Go. This memory-safety vulnerability could allow an attacker to cause various impacts, such as denial of service (DoS) or potentially arbitrary code execution, by exploiting memory corruption issues. The exact method of exploitation and specific consequences would depend on the nature of the memory corruption.
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
A flaw was found in ws, an open source WebSocket client and server. A remote attacker can exploit this memory exhaustion vulnerability by sending a high volume of exceptionally small fragments and data chunks. This action forces the affected component to allocate and hold structural wrappers that consume excessive memory. Consequently, this leads to process termination and a denial of service (DoS) for the remote peer.
Loading 1.8 MB of JSON…
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.