Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update
vault: Hashicorp Vault AWS IAM Integration Authentication Bypass vault: GCP Auth Method Allows Authentication Bypass validator: Inefficient Regular Expression Complexity in Validator.js nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes go-yaml: Denial of Service in go-yaml goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be vault: incorrect policy enforcement nodejs: Improper handling of URI Subject Alternative Names nodejs: Certificate Verification Bypass via String Injection nodejs: Incorrect handling of certificate subject and issuer fields golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters nodejs-minimatch: ReDoS via the braceExpand function nodejs: Prototype pollution via console.table properties jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC golang: net/http: handle server errors after sending GOAWAY golang: encoding/gob: stack exhaustion in Decoder.Decode golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service golang: net/url: JoinPath does not strip relative path components in all circumstances consul: Consul Template May Expose Vault Secrets When Processing Invalid Input decode-uri-component: improper input validation resulting in DoS vault: insufficient certificate revocation list checking golang: regexp/syntax: limit memory used by parsing regexps golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption json5: Prototype Pollution in JSON5 via Parse Method vault: Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File hashicorp/vault: Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata Hashicorp/vault: Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations
cpe:/a:redhat:openshift_data_foundation:4.13::el9