Filtered by vendor Redhat Subscriptions
Filtered by product Cluster Observability Operator Subscriptions

Search

Switch to Advanced Search (Beta)
Total 5 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-45338 1 Redhat 19 Acm, Advanced Cluster Security, Cert Manager and 16 more 2025-02-21 5.3 Medium
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.
CVE-2024-28849 1 Redhat 14 Acm, Advanced Cluster Security, Ansible Automation Platform and 11 more 2025-02-13 6.5 Medium
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-24786 2 Golang, Redhat 23 Go, Acm, Cluster Observability Operator and 20 more 2025-02-13 7.5 High
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.
CVE-2023-26159 2 Follow-redirects, Redhat 14 Follow Redirects, Acm, Cluster Observability Operator and 11 more 2025-02-13 7.3 High
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
CVE-2024-6104 2 Hashicorp, Redhat 12 Retryablehttp, Advanced Cluster Security, Cert Manager and 9 more 2024-11-21 6 Medium
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.