rhsa-2025:1249
Vulnerability from csaf_redhat
Published
2025-02-10 18:38
Modified
2025-02-19 08:00
Summary
Red Hat Security Advisory: updated discovery container images
Notes
Topic
Updated container images are now available for Discovery 1.12.
Details
The Discovery container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).
Dockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.
Fixed CVEs:
CVE-2024-39338
CVE-2024-56201
CVE-2024-45590
CVE-2024-41991
CVE-2024-42005
CVE-2024-41989
CVE-2024-8775
CVE-2024-43799
CVE-2024-43796
CVE-2024-43800
CVE-2024-45296
CVE-2024-43788
CVE-2024-21536
CVE-2024-56326
CVE-2024-21538
CVE-2020-11023
CVE-2024-55565
CVE-2023-44270
CVE-2024-6485
CVE-2024-53907
CVE-2024-56374
CVE-2024-52798
CVE-2024-31449
CVE-2024-46981
CVE-2024-31228
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated container images are now available for Discovery 1.12.",
"title": "Topic"
},
{
"category": "general",
"text": "The Discovery container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to these new images specifically, or to the latest images generally.\n\nFixed CVEs:\nCVE-2024-39338\nCVE-2024-56201\nCVE-2024-45590\nCVE-2024-41991\nCVE-2024-42005\nCVE-2024-41989\nCVE-2024-8775\nCVE-2024-43799\nCVE-2024-43796\nCVE-2024-43800\nCVE-2024-45296\nCVE-2024-43788\nCVE-2024-21536\nCVE-2024-56326\nCVE-2024-21538\nCVE-2020-11023\nCVE-2024-55565\nCVE-2023-44270\nCVE-2024-6485\nCVE-2024-53907\nCVE-2024-56374\nCVE-2024-52798\nCVE-2024-31449\nCVE-2024-46981\nCVE-2024-31228",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:1249",
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "DISCOVERY-895",
"url": "https://issues.redhat.com/browse/DISCOVERY-895"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1249.json"
}
],
"title": "Red Hat Security Advisory: updated discovery container images",
"tracking": {
"current_release_date": "2025-02-19T08:00:25+00:00",
"generator": {
"date": "2025-02-19T08:00:25+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.3.1"
}
},
"id": "RHSA-2025:1249",
"initial_release_date": "2025-02-10T18:38:39+00:00",
"revision_history": [
{
"date": "2025-02-10T18:38:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-02-10T18:38:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-02-19T08:00:25+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Discovery 1 for RHEL 9",
"product": {
"name": "Discovery 1 for RHEL 9",
"product_id": "9Base-discovery-1",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:discovery:1.0::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Discovery"
},
{
"branches": [
{
"category": "product_version",
"name": "discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"product": {
"name": "discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"product_id": "discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1.12.0-1"
}
}
},
{
"category": "product_version",
"name": "discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64",
"product": {
"name": "discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64",
"product_id": "discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a?arch=amd64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1.12.0-1"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"product": {
"name": "discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"product_id": "discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-server-rhel9\u0026tag=1.12.0-1"
}
}
},
{
"category": "product_version",
"name": "discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"product": {
"name": "discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"product_id": "discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c?arch=arm64\u0026repository_url=registry.redhat.io/discovery/discovery-ui-rhel9\u0026tag=1.12.0-1"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64 as a component of Discovery 1 for RHEL 9",
"product_id": "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64"
},
"product_reference": "discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"relates_to_product_reference": "9Base-discovery-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64 as a component of Discovery 1 for RHEL 9",
"product_id": "9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64"
},
"product_reference": "discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"relates_to_product_reference": "9Base-discovery-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64 as a component of Discovery 1 for RHEL 9",
"product_id": "9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64"
},
"product_reference": "discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"relates_to_product_reference": "9Base-discovery-1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64 as a component of Discovery 1 for RHEL 9",
"product_id": "9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
},
"product_reference": "discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64",
"relates_to_product_reference": "9Base-discovery-1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-11023",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2020-06-23T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1850004"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-11023"
},
{
"category": "external",
"summary": "RHBZ#1850004",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-11023"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023"
},
{
"category": "external",
"summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/",
"url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2020-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2025-01-23T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods"
},
{
"cve": "CVE-2023-44270",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2024-11-18T14:11:50.400987+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2326998"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "PostCSS: Improper input validation in PostCSS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-44270"
},
{
"category": "external",
"summary": "RHBZ#2326998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2326998"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-44270",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-44270"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-44270",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44270"
},
{
"category": "external",
"summary": "https://github.com/github/advisory-database/issues/2820",
"url": "https://github.com/github/advisory-database/issues/2820"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25",
"url": "https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5",
"url": "https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5"
},
{
"category": "external",
"summary": "https://github.com/postcss/postcss/releases/tag/8.4.31",
"url": "https://github.com/postcss/postcss/releases/tag/8.4.31"
}
],
"release_date": "2023-09-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "There\u0027s no known mitigation for this issue. Red Hat recommends to not parse untrusted CSS input using PostCSS.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "PostCSS: Improper input validation in PostCSS"
},
{
"cve": "CVE-2024-6485",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2024-07-11T17:30:47+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2297388"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in bootstrap associated with the data-loading-text attribute within the button plugin. This vulnerability allows malicious JavaScript code to be injected into the attribute, which is then executed when the button\u0027s loading state is triggered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bootstrap: Cross-Site Scripting via button plugin on bootstrap",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-6485"
},
{
"category": "external",
"summary": "RHBZ#2297388",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2297388"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-6485",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6485"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-6485",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6485"
},
{
"category": "external",
"summary": "https://www.herodevs.com/vulnerability-directory/cve-2024-6485",
"url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6485"
}
],
"release_date": "2024-07-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bootstrap: Cross-Site Scripting via button plugin on bootstrap"
},
{
"cve": "CVE-2024-8775",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2024-09-13T08:31:27.781000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2312119"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible-core: Exposure of Sensitive Information in Ansible Vault Files Due to Improper Logging",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is classified as moderate rather than important because while it does expose sensitive information during playbook execution, the exposure is limited to logs and output generated during the run, which is typically accessible only to authorized users with sufficient privileges. The flaw does not result in an immediate or direct compromise of systems, as no remote exploitation vector is introduced. Additionally, the risk can be mitigated through proper configuration (`no_log: true`) and access control measures, reducing the likelihood of unauthorized access to the logged data. However, the unintentional disclosure of secrets like passwords or API keys still presents a potential risk for privilege escalation or lateral movement within an environment, justifying a moderate severity rating.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-8775"
},
{
"category": "external",
"summary": "RHBZ#2312119",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2312119"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-8775",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8775"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-8775",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8775"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-jpxc-vmjf-9fcj",
"url": "https://github.com/advisories/GHSA-jpxc-vmjf-9fcj"
}
],
"release_date": "2024-09-13T08:35:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ansible-core: Exposure of Sensitive Information in Ansible Vault Files Due to Improper Logging"
},
{
"cve": "CVE-2024-21536",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2024-10-19T06:00:36.846953+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2319884"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the http-proxy-middleware package. Affected versions of this package are vulnerable to denial of service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. This flaw allows an attacker to kill the Node.js process and crash the server by requesting certain paths.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "http-proxy-middleware: Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-21536"
},
{
"category": "external",
"summary": "RHBZ#2319884",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2319884"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-21536",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21536"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-21536",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21536"
},
{
"category": "external",
"summary": "https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a",
"url": "https://gist.github.com/mhassan1/28be67266d82a53708ed59ce5dc3c94a"
},
{
"category": "external",
"summary": "https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5",
"url": "https://github.com/chimurai/http-proxy-middleware/commit/0b4274e8cc9e9a2c5a06f35fbf456ccfcebc55a5"
},
{
"category": "external",
"summary": "https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22",
"url": "https://github.com/chimurai/http-proxy-middleware/commit/788b21e4aff38332d6319557d4a5b1b13b1f9a22"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906",
"url": "https://security.snyk.io/vuln/SNYK-JS-HTTPPROXYMIDDLEWARE-8229906"
}
],
"release_date": "2024-10-19T05:00:04.056000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Red Hat Product Security does not have any mitigation recommendations at this time.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "http-proxy-middleware: Denial of Service"
},
{
"cve": "CVE-2024-21538",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2024-11-08T13:44:29.182678+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2324550"
}
],
"notes": [
{
"category": "description",
"text": "A Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package for Node.js. Due to improper input sanitization, an attacker can increase CPU usage and crash the program with a large, specially crafted string.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cross-spawn: regular expression denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-21538"
},
{
"category": "external",
"summary": "RHBZ#2324550",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2324550"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-21538",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-21538"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-21538",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21538"
},
{
"category": "external",
"summary": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff",
"url": "https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff"
},
{
"category": "external",
"summary": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f",
"url": "https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f"
},
{
"category": "external",
"summary": "https://github.com/moxystudio/node-cross-spawn/pull/160",
"url": "https://github.com/moxystudio/node-cross-spawn/pull/160"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230",
"url": "https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230"
}
],
"release_date": "2024-11-08T05:00:04.695000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "cross-spawn: regular expression denial of service"
},
{
"cve": "CVE-2024-31228",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2024-10-07T20:01:32.319599+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2317058"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Redis. This flaw allows authenticated users to trigger a denial of service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST`, and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "redis: Denial-of-service due to unbounded pattern matching in Redis",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-31228"
},
{
"category": "external",
"summary": "RHBZ#2317058",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317058"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-31228",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-31228"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-31228",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31228"
},
{
"category": "external",
"summary": "https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0",
"url": "https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0"
},
{
"category": "external",
"summary": "https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976",
"url": "https://github.com/redis/redis/security/advisories/GHSA-66gq-c942-6976"
}
],
"release_date": "2024-10-07T19:51:06.784000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "redis: Denial-of-service due to unbounded pattern matching in Redis"
},
{
"cve": "CVE-2024-31449",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2024-10-07T20:01:19.998028+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2317056"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Redis. This flaw allows an authenticated user to use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may lead to remote code execution. The problem exists in all versions of Redis with Lua scripting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "redis: Lua library commands may lead to stack overflow and RCE in Redis",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-31449"
},
{
"category": "external",
"summary": "RHBZ#2317056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317056"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-31449",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-31449"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-31449",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31449"
},
{
"category": "external",
"summary": "https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9",
"url": "https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9"
},
{
"category": "external",
"summary": "https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5",
"url": "https://github.com/redis/redis/security/advisories/GHSA-whxg-wx83-85p5"
}
],
"release_date": "2024-10-07T19:51:08.775000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "redis: Lua library commands may lead to stack overflow and RCE in Redis"
},
{
"cve": "CVE-2024-39338",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2024-08-13T17:21:32.774718+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2304369"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in the Axios HTTP Client. It is vulnerable to a server-side request forgery attack (SSRF) caused by unexpected behavior where requests for path-relative URLs get processed as protocol-relative URLs. This flaw allows an attacker to perform arbitrary requests from the server, potentially accessing internal systems or exfiltrating sensitive data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: axios: Server-Side Request Forgery",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as IMPORTANT because it can be exploited remotely with low complexity and without user interaction, it poses a significant risk to confidentiality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-39338"
},
{
"category": "external",
"summary": "RHBZ#2304369",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2304369"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-39338",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39338"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-39338",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39338"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/releases",
"url": "https://github.com/axios/axios/releases"
},
{
"category": "external",
"summary": "https://jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html",
"url": "https://jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html"
}
],
"release_date": "2024-08-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: axios: Server-Side Request Forgery"
},
{
"cve": "CVE-2024-41989",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2024-08-02T01:40:06+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2302433"
}
],
"notes": [
{
"category": "description",
"text": "A security issue was found in Django. If \u0027floatformat\u0027 received a string representation of a number in scientific notation with a large exponent, it could lead to significant memory consumption. To avoid this, decimals with more than 200 digits are now returned as is.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Memory exhaustion in django.utils.numberformat.floatformat()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is categorized as moderate severity rather than important because, while it has the potential to cause significant memory consumption under specific conditions, the likelihood of such a scenario occurring in typical applications is relatively low. The issue arises primarily when processing extremely large numbers in scientific notation, which is not a common use case in most Django applications. Additionally, the impact is localized to the floatformat function, and the issue does not expose sensitive data or compromise the integrity of the application.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-41989"
},
{
"category": "external",
"summary": "RHBZ#2302433",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302433"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-41989",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41989"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-41989",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41989"
}
],
"release_date": "2024-08-06T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Memory exhaustion in django.utils.numberformat.floatformat()"
},
{
"cve": "CVE-2024-41991",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2024-08-02T02:03:22+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2302435"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Django. \u0027urlize\u0027, \u0027urlizetrunc\u0027, and \u0027AdminURLFieldWidget\u0027 may be subject to a denial of service attack via certain inputs with a very large number of Unicode characters.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The identified vulnerability in Django\u0027s urlize, urlizetrunc template filters, and the AdminURLFieldWidget widget is classified as moderate severity rather than important due to its specific attack vector and impact. While the flaw allows for a potential denial-of-service (DoS) attack via inputs with a large number of Unicode characters, exploiting this vulnerability requires a significant volume of data to be processed by these components, which is a non-trivial task. Additionally, standard mitigation measures such as input validation, rate limiting, and monitoring can effectively reduce the risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-41991"
},
{
"category": "external",
"summary": "RHBZ#2302435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302435"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-41991",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-41991"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-41991",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41991"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases/",
"url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases/"
}
],
"release_date": "2024-08-06T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget"
},
{
"cve": "CVE-2024-42005",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2024-08-02T02:08:30+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2302436"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Django. The QuerySet.values() and QuerySet.values_list() methods on models with a JSONField were subject to SQL injection in column aliases via a crafted JSON object key as a passed *arg.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-django: Potential SQL injection in QuerySet.values() and values_list()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is considered of moderate severity rather than high or critical because it requires specific conditions to be exploitable. The potential for SQL injection exists only when QuerySet.values() or values_list() methods are used on models with a JSONField, and an attacker must have control over the JSON object keys passed as arguments. In typical use cases, these methods are often used with predefined or controlled data, limiting the attack surface. Furthermore, the impact is constrained to the manipulation of column aliases, rather than direct injection into more critical parts of the SQL query, reducing the overall risk compared to more direct forms of SQL injection vulnerabilities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-42005"
},
{
"category": "external",
"summary": "RHBZ#2302436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-42005",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-42005"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-42005",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42005"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases/",
"url": "https://www.djangoproject.com/weblog/2024/aug/06/security-releases/"
}
],
"release_date": "2024-08-06T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-django: Potential SQL injection in QuerySet.values() and values_list()"
},
{
"cve": "CVE-2024-43788",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2024-08-27T17:20:06.890123+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2308193"
}
],
"notes": [
{
"category": "description",
"text": "A DOM Clobbering vulnerability was found in Webpack via `AutoPublicPathRuntimeModule`. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script through seemingly benign HTML markups in the webpage, for example, through a post or comment, and leverages the gadgets (pieces of JS code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to Cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or ID attributes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The severity of this issue is classified as moderate rather than important due to the specific conditions required for exploitation. DOM Clobbering, while serious, can only be leveraged in environments where an attacker has the ability to inject unsanitized HTML attributes (e.g., `name` or `id`) into a web page. This limits the attack surface to applications that improperly sanitize user input and rely on Webpack-generated files. Furthermore, the exploitation depends on existing vulnerabilities in the sanitization process, rather than the direct execution of arbitrary scripts. As a result, while the issue can lead to XSS, its impact is constrained by the contextual requirement of HTML injection, lowering its overall severity compared to more direct XSS vectors.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-43788"
},
{
"category": "external",
"summary": "RHBZ#2308193",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2308193"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-43788",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43788"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43788",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43788"
},
{
"category": "external",
"summary": "https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61",
"url": "https://github.com/webpack/webpack/commit/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61"
},
{
"category": "external",
"summary": "https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986",
"url": "https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986"
},
{
"category": "external",
"summary": "https://research.securitum.com/xss-in-amp4email-dom-clobbering",
"url": "https://research.securitum.com/xss-in-amp4email-dom-clobbering"
},
{
"category": "external",
"summary": "https://scnps.co/papers/sp23_domclob.pdf",
"url": "https://scnps.co/papers/sp23_domclob.pdf"
}
],
"release_date": "2024-08-27T17:15:07.967000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule"
},
{
"cve": "CVE-2024-43796",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2024-09-10T15:30:28.106254+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2311152"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Express. This vulnerability allows untrusted code execution via passing untrusted user input to response.redirect(), even if the input is sanitized.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "express: Improper Input Handling in Express Redirects",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-43796"
},
{
"category": "external",
"summary": "RHBZ#2311152",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311152"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-43796",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43796"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43796"
},
{
"category": "external",
"summary": "https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553",
"url": "https://github.com/expressjs/express/commit/54271f69b511fea198471e6ff3400ab805d6b553"
},
{
"category": "external",
"summary": "https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx",
"url": "https://github.com/expressjs/express/security/advisories/GHSA-qw6h-vgh9-j6wx"
}
],
"release_date": "2024-09-10T15:15:17.510000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "express: Improper Input Handling in Express Redirects"
},
{
"cve": "CVE-2024-43799",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2024-09-10T15:30:30.869487+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2311153"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Send library. This vulnerability allows remote code execution via untrusted input passed to the SendStream.redirect() function.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "send: Code Execution Vulnerability in Send Library",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-43799"
},
{
"category": "external",
"summary": "RHBZ#2311153",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311153"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-43799",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43799"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43799",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43799"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35",
"url": "https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg",
"url": "https://github.com/pillarjs/send/security/advisories/GHSA-m6fv-jmcg-4jfg"
}
],
"release_date": "2024-09-10T15:15:17.727000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "send: Code Execution Vulnerability in Send Library"
},
{
"cve": "CVE-2024-43800",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2024-09-10T15:30:33.631718+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2311154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "serve-static: Improper Sanitization in serve-static",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-43800"
},
{
"category": "external",
"summary": "RHBZ#2311154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-43800",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43800"
},
{
"category": "external",
"summary": "https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b",
"url": "https://github.com/expressjs/serve-static/commit/0c11fad159898cdc69fd9ab63269b72468ecaf6b"
},
{
"category": "external",
"summary": "https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa",
"url": "https://github.com/expressjs/serve-static/commit/ce730896fddce1588111d9ef6fdf20896de5c6fa"
},
{
"category": "external",
"summary": "https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p",
"url": "https://github.com/expressjs/serve-static/security/advisories/GHSA-cm22-4g7w-348p"
}
],
"release_date": "2024-09-10T15:15:17.937000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "serve-static: Improper Sanitization in serve-static"
},
{
"cve": "CVE-2024-45296",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2024-09-09T19:20:18.127723+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2310908"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: Backtracking regular expressions cause ReDoS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-45296"
},
{
"category": "external",
"summary": "RHBZ#2310908",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310908"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-45296",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45296"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45296",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45296"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f",
"url": "https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6",
"url": "https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j",
"url": "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j"
}
],
"release_date": "2024-09-09T19:15:13.330000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "path-to-regexp: Backtracking regular expressions cause ReDoS"
},
{
"cve": "CVE-2024-45590",
"cwe": {
"id": "CWE-405",
"name": "Asymmetric Resource Consumption (Amplification)"
},
"discovery_date": "2024-09-10T16:20:29.292154+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2311171"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in body-parser. This vulnerability causes denial of service via a specially crafted payload when the URL encoding is enabled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "body-parser: Denial of Service Vulnerability in body-parser",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-45590"
},
{
"category": "external",
"summary": "RHBZ#2311171",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2311171"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-45590",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45590"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45590",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45590"
},
{
"category": "external",
"summary": "https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce",
"url": "https://github.com/expressjs/body-parser/commit/b2695c4450f06ba3b0ccf48d872a229bb41c9bce"
},
{
"category": "external",
"summary": "https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7",
"url": "https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7"
}
],
"release_date": "2024-09-10T16:15:21.083000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "body-parser: Denial of Service Vulnerability in body-parser"
},
{
"cve": "CVE-2024-46981",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2025-01-06T22:00:39.382359+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2336004"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Redis server. This flaw allows an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, potentially leading to remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "redis: Redis\u0027 Lua library commands may lead to remote code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The problem exists in all versions of Redis with Lua scripting.\n\nThis vulnerability in Redis is classified as high severity rather than moderate due to its potential impact and exploitation scope. By manipulating the Lua garbage collector through crafted scripts, an authenticated attacker can achieve remote code execution (RCE), allowing them to execute arbitrary commands on the host system. This compromises not only the integrity and confidentiality of the data stored in Redis but also the underlying server itself. Furthermore, the exploitation does not require direct access to the server binary, making it feasible for attackers to execute through legitimate, albeit malicious, commands.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-46981"
},
{
"category": "external",
"summary": "RHBZ#2336004",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2336004"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-46981",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-46981"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-46981",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46981"
},
{
"category": "external",
"summary": "https://github.com/redis/redis/releases/tag/6.2.17",
"url": "https://github.com/redis/redis/releases/tag/6.2.17"
},
{
"category": "external",
"summary": "https://github.com/redis/redis/releases/tag/7.2.7",
"url": "https://github.com/redis/redis/releases/tag/7.2.7"
},
{
"category": "external",
"summary": "https://github.com/redis/redis/releases/tag/7.4.2",
"url": "https://github.com/redis/redis/releases/tag/7.4.2"
},
{
"category": "external",
"summary": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c",
"url": "https://github.com/redis/redis/security/advisories/GHSA-39h2-x6c4-6w4c"
}
],
"release_date": "2025-01-06T21:11:51.687000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "A workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "redis: Redis\u0027 Lua library commands may lead to remote code execution"
},
{
"cve": "CVE-2024-52798",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2024-12-05T23:00:59.020167+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2330689"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp. A path-to-regexp turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability exists because of an incomplete fix for CVE-2024-45296.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-52798"
},
{
"category": "external",
"summary": "RHBZ#2330689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-52798",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52798"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-52798",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52798"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4",
"url": "https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4"
},
{
"category": "external",
"summary": "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w",
"url": "https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-rhx6-c78j-4q9w"
}
],
"release_date": "2024-12-05T22:45:42.774000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Avoid using two parameters within a single path segment when the separator is not, for example, /:a-:b. Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "path-to-regexp: path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x"
},
{
"cve": "CVE-2024-53907",
"cwe": {
"id": "CWE-1169",
"name": "CWE-1169"
},
"discovery_date": "2024-11-28T02:48:36.215000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2329288"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found in the Django Web Framework. The strip_tags() and stripbtags template filter may be vulnerable to a potential denial of service (DoS) in cases of a large sequence of nested incomplete HTML entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "django: Potential denial-of-service in django.utils.html.strip_tags()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as a Moderate severity because it exposes the strip_tags() method and striptags template filter to a potential denial-of-service attack, malicious input containing large sequences of nested incomplete HTML entities could cause excessive processing, but it does not affect data confidentiality or integrity",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-53907"
},
{
"category": "external",
"summary": "RHBZ#2329288",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2329288"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-53907",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53907"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-53907",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53907"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2024/dec/04/security-releases/",
"url": "https://www.djangoproject.com/weblog/2024/dec/04/security-releases/"
}
],
"release_date": "2024-12-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "django: Potential denial-of-service in django.utils.html.strip_tags()"
},
{
"cve": "CVE-2024-55565",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2024-12-09T02:00:45.255738+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2331063"
}
],
"notes": [
{
"category": "description",
"text": "nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nanoid: nanoid mishandles non-integer values",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-55565"
},
{
"category": "external",
"summary": "RHBZ#2331063",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2331063"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-55565",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-55565"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-55565",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55565"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/compare/3.3.7...3.3.8",
"url": "https://github.com/ai/nanoid/compare/3.3.7...3.3.8"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/pull/510",
"url": "https://github.com/ai/nanoid/pull/510"
},
{
"category": "external",
"summary": "https://github.com/ai/nanoid/releases/tag/5.0.9",
"url": "https://github.com/ai/nanoid/releases/tag/5.0.9"
}
],
"release_date": "2024-12-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nanoid: nanoid mishandles non-integer values"
},
{
"cve": "CVE-2024-56201",
"cwe": {
"id": "CWE-150",
"name": "Improper Neutralization of Escape, Meta, or Control Sequences"
},
"discovery_date": "2024-12-23T16:00:38.768252+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2333854"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja\u0027s sandbox being used. An attacker needs to be able to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates where the template author can also choose the template filename.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jinja2: Jinja has a sandbox breakout through malicious filenames",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has rated as a IMPORTANT flaw because an attacker controlling both the template content and filename to execute arbitrary Python code, bypassing the sandbox.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56201"
},
{
"category": "external",
"summary": "RHBZ#2333854",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333854"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56201",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56201"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56201"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f",
"url": "https://github.com/pallets/jinja/commit/767b23617628419ae3709ccfb02f9602ae9fe51f"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/issues/1792",
"url": "https://github.com/pallets/jinja/issues/1792"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/releases/tag/3.1.5",
"url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-gmj6-6f8f-6699"
}
],
"release_date": "2024-12-23T15:37:36.110000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
},
{
"category": "workaround",
"details": "To mitigate this vulnerabilty restrict user-controlled template filenames, ensuring they follow a predefined templates.",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jinja2: Jinja has a sandbox breakout through malicious filenames"
},
{
"cve": "CVE-2024-56326",
"cwe": {
"id": "CWE-693",
"name": "Protection Mechanism Failure"
},
"discovery_date": "2024-12-23T16:00:46.619763+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2333856"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications that execute untrusted templates. Jinja\u0027s sandbox does catch calls to str.format and ensures they don\u0027t escape the sandbox. However, storing a reference to a malicious string\u0027s format method is possible, then passing that to a filter that calls it. No such filters are built into Jinja but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jinja2: Jinja has a sandbox breakout through indirect reference to format method",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate due to an oversight in Jinja\u0027s sandbox environment, allowing attackers to execute arbitrary Python code through controlled template content. This requires control over template content, making exploitation possible only in specific applications, thus limiting its overall impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56326"
},
{
"category": "external",
"summary": "RHBZ#2333856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333856"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56326",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56326"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56326",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56326"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4",
"url": "https://github.com/pallets/jinja/commit/48b0687e05a5466a91cd5812d604fa37ad0943b4"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/releases/tag/3.1.5",
"url": "https://github.com/pallets/jinja/releases/tag/3.1.5"
},
{
"category": "external",
"summary": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h",
"url": "https://github.com/pallets/jinja/security/advisories/GHSA-q2x7-8rv6-6q7h"
}
],
"release_date": "2024-12-23T15:43:49.400000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jinja2: Jinja has a sandbox breakout through indirect reference to format method"
},
{
"cve": "CVE-2024-56374",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-01-14T20:01:09.167282+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2337996"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Django framework. Lack of upper bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial of service attack. The undocumented and private functions `clean_ipv6_address` and `is_valid_ipv6_address` were vulnerable, as was the `django.forms.GenericIPAddressField` form field, which has now been updated to define a `max_length` of 39 characters.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "django: potential denial-of-service vulnerability in IPv6 validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-56374"
},
{
"category": "external",
"summary": "RHBZ#2337996",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2337996"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-56374",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56374"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56374",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56374"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2025/01/14/2",
"url": "http://www.openwall.com/lists/oss-security/2025/01/14/2"
},
{
"category": "external",
"summary": "https://docs.djangoproject.com/en/dev/releases/security/",
"url": "https://docs.djangoproject.com/en/dev/releases/security/"
},
{
"category": "external",
"summary": "https://groups.google.com/g/django-announce",
"url": "https://groups.google.com/g/django-announce"
},
{
"category": "external",
"summary": "https://www.djangoproject.com/weblog/2025/jan/14/security-releases/",
"url": "https://www.djangoproject.com/weblog/2025/jan/14/security-releases/"
}
],
"release_date": "2025-01-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-02-10T18:38:39+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:1249"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:b41eeb83e5c7ad9937a90ac6247fe5305a7ff90b39ae6a23765e0f2e22bdca70_arm64",
"9Base-discovery-1:discovery/discovery-server-rhel9@sha256:c6488740a778ca3a1aa3dfdc513d4989ac366728d9f93fe8a57a51c562270771_amd64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c5a4ba16f7322e2b89fefa198dc673434f73709a47cf7a85bbccf1ba7a73dd7c_arm64",
"9Base-discovery-1:discovery/discovery-ui-rhel9@sha256:c6f7be7cb58e77958c518fdd68c80a745dcec48fa5397af8c68593254e03743a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "django: potential denial-of-service vulnerability in IPv6 validation"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.