title: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
description: rpm: TOCTOU race in checks for unsafe symlinks rpm: races with chown/chmod/capabilities calls during installation rpm: checks for unsafe symlinks are not performed for intermediary directories Hashicorp/vault: Vault’s LDAP Auth Method Allows for User Enumeration openssl: Incorrect cipher key and IV length processing vault: inbound client requests can trigger a denial of service gnutls: timing side-channel in the RSA-PSK authentication sqlite: heap-buffer-overflow at sessionfuzz golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() python: Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple sudo: Sudo does not escape control characters in log messages sudo: Sudo does not escape control characters in sudoreplay output golang: net/http: insufficient sanitization of Host header golang: crypto/tls: slow verification of certificate chains containing large RSA keys golang: html/template: improper handling of HTML-like comments within script contexts golang: html/template: improper handling of special tags within script contexts golang: crypto/tls: panic when processing post-handshake message on QUIC connections golang: crypto/tls: lack of a limit on buffered post-handshake libxml2: crafted xml can cause global buffer overflow nodejs-ip: arbitrary code execution via the isPublic() function sudo: Targeted Corruption of Register and Stack Variables get-func-name: ReDoS in chai module python-urllib3: Cookie request header isn't stripped during cross-origin redirects urllib3: Request body not stripped after redirect from 303 status changes request method to GET curl: information disclosure by exploiting a mixed case flaw css-tools: regular expression denial of service (ReDoS) when parsing CSS ssh: Prefix truncation attack on Binary Packet Protocol (BPP) openssh: potential command injection via shell metacharacters gnutls: incomplete fix for CVE-2023-5981 gnutls: rejects certificate chain with distributed trust
cpes: cpe:/a:redhat:openshift_data_foundation:4.15::el9