title: Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.3
description: nodejs-glob-parent: Regular expression denial of service nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag nodejs-ansi_up: XSS due to insufficient URL sanitization oras: zip-slip vulnerability via oras-pull redis: integer overflow when configurable limit for maximum supported bulk input size is too big on 32-bit platforms fastify-reply-from: crafted URL allows prefix scape of the proxied backend service fastify-http-proxy: crafted URL allows prefix scape of the proxied backend service nodejs-lodash: command injection via template nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe html-parse-stringify: Regular Expression DoS nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl() browserslist: parsing of invalid queries could result in Regular Expression Denial of Service (ReDoS) nodejs-postcss: Regular expression denial of service during source map parsing nodejs-handlebars: Remote code execution when compiling untrusted compile templates with strict:true option nodejs-postcss: ReDoS via getAnnotationURL() and loadAnnotation() in lib/previous-map.js nodejs-handlebars: Remote code execution when compiling untrusted compile templates with compat:true option openssl: incorrect SSLv2 rollback protection openssl: integer overflow in CipherUpdate openssl: NULL pointer dereference in X509_issuer_and_serial_hash() nodejs-ua-parser-js: ReDoS via malicious User-Agent header grafana: snapshot feature allow an unauthenticated remote attacker to trigger a DoS via a remote API call nodejs-is-svg: ReDoS via malicious string nodejs-netmask: improper input validation of octal input data nodejs-netmask: incorrectly parses an IP address that has octal integer with invalid character redis: Integer overflow via STRALGO LCS command redis: Integer overflow via COPY command for large intsets ulikunitz/xz: Infinite loop in readUvarint allows for denial of service nodejs-normalize-url: ReDoS for data URLs nodejs-trim-newlines: ReDoS in .end() method
cpes: cpe:/a:redhat:acm:2.3::el7 cpe:/a:redhat:acm:2.3::el8