Filtered by vendor Redhat Subscriptions
Filtered by product Openshift Subscriptions
Total 1129 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-40694 2 Ibm, Redhat 2 Watson Cp4d Data Stores, Openshift 2025-08-20 6.2 Medium
IBM Watson CP4D Data Stores 4.0.0 through 4.8.4 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 264838.
CVE-2024-51465 2 Ibm, Redhat 2 App Connect Enterprise Certified Container, Openshift 2025-08-14 8.8 High
IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
CVE-2022-43916 2 Ibm, Redhat 2 App Connect Enterprise Certified Container, Openshift 2025-08-13 6.8 Medium
IBM App Connect Enterprise Certified Container 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, and 12.7 Pods do not restrict network egress for Pods that are used for internal infrastructure.
CVE-2022-1471 2 Redhat, Snakeyaml Project 14 Amq Clients, Amq Streams, Enterprise Linux and 11 more 2025-06-18 8.3 High
SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond.
CVE-2023-49568 2 Go-git Project, Redhat 10 Go-git, Acm, Advanced Cluster Security and 7 more 2025-06-18 7.5 High
A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.11. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Applications using only the in-memory filesystem supported by go-git are not affected by this vulnerability. This is a go-git implementation issue and does not affect the upstream git cli.
CVE-2024-3652 2 Libreswan, Redhat 7 Libreswan, Enterprise Linux, Openshift and 4 more 2025-06-17 6.5 Medium
The Libreswan Project was notified of an issue causing libreswan to restart when using IKEv1 without specifying an esp= line. When the peer requests AES-GMAC, libreswan's default proposal handler causes an assertion failure and crashes and restarts. IKEv2 connections are not affected.
CVE-2021-25736 3 Kubernetes, Microsoft, Redhat 3 Kubernetes, Windows, Openshift 2025-06-12 5.8 Medium
Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port (“spec.ports[*].port”) as a LoadBalancer Service when the LoadBalancer controller does not set the “status.loadBalancer.ingress[].ip” field. Clusters where the LoadBalancer controller sets the “status.loadBalancer.ingress[].ip” field are unaffected.
CVE-2024-6119 3 Netapp, Openssl, Redhat 34 500f, 500f Firmware, A250 and 31 more 2025-06-03 7.5 High
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherName` subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program. Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address. TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
CVE-2022-2995 2 Kubernetes, Redhat 2 Cri-o, Openshift 2025-05-29 7.1 High
Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.
CVE-2022-41966 2 Redhat, Xstream 10 Camel Quarkus, Camel Spring Boot, Jboss Enterprise Bpms Platform and 7 more 2025-05-23 8.2 High
XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable.
CVE-2024-21538 2 Cross-spawn, Redhat 12 Cross-spawn, Advanced Cluster Security, Discovery and 9 more 2025-05-20 7.5 High
Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.
CVE-2023-3966 3 Fedoraproject, Openvswitch, Redhat 4 Fedora, Openvswitch, Enterprise Linux and 1 more 2025-05-16 7.5 High
A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.
CVE-2022-32149 2 Golang, Redhat 10 Text, Acm, Container Native Virtualization and 7 more 2025-05-16 7.5 High
An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.
CVE-2024-21626 3 Fedoraproject, Linuxfoundation, Redhat 10 Fedora, Runc, Enterprise Linux and 7 more 2025-05-15 8.6 High
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.
CVE-2022-41316 2 Hashicorp, Redhat 3 Vault, Openshift, Openshift Data Foundation 2025-05-15 5.3 Medium
HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.
CVE-2017-7517 1 Redhat 1 Openshift 2025-05-14 3.5 Low
An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a user creates a project called "MyProject", and then later deletes it another user can then create a project called "MyProject" and access the metrics stored from the original "MyProject" instance.
CVE-2013-4253 1 Redhat 1 Openshift 2025-05-09 7.5 High
The deployment script in the unsupported "OpenShift Extras" set of add-on scripts, in Red Hat Openshift 1, installs a default public key in the root user's authorized_keys file.
CVE-2013-4281 1 Redhat 1 Openshift 2025-05-09 5.5 Medium
In Red Hat Openshift 1, weak default permissions are applied to the /etc/openshift/server_priv.pem file on the broker server, which could allow users with local access to the broker to read this file.
CVE-2022-43409 2 Jenkins, Redhat 3 Pipeline\, Ocp Tools, Openshift 2025-05-08 5.4 Medium
Jenkins Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of hyperlinks sending POST requests in build logs, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.
CVE-2022-43408 2 Jenkins, Redhat 3 Pipeline\, Ocp Tools, Openshift 2025-05-08 6.5 Medium
Jenkins Pipeline: Stage View Plugin 2.26 and earlier does not correctly encode the ID of 'input' steps when using it to generate URLs to proceed or abort Pipeline builds, allowing attackers able to configure Pipelines to specify 'input' step IDs resulting in URLs that would bypass the CSRF protection of any target URL in Jenkins.