automation-gateway-proxy-server vulnerabilities (Red Hat)
56 vulnerabilities.
automation-gateway-proxy-serverRed HatAap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header8.2 Highautomation-gateway-proxy-serverRed HatEda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn7.5 Highautomation-gateway-proxy-serverRed Hatpyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service7.5 Highautomation-gateway-proxy-serverRed Hatpyasn1: Uncontrolled resource consumption when converting decoded REAL values7.5 Highautomation-gateway-proxy-serverRed HatPillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`8.2 Highautomation-gateway-proxy-serverRed HatPillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading7.5 Highautomation-gateway-proxy-serverRed HatPillow GdImageFile decompression bomb protection bypass7.5 Highautomation-gateway-proxy-serverRed HatPillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`7.5 Highautomation-gateway-proxy-serverRed HatPillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading7.5 Highautomation-gateway-proxy-serverRed Hatquic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion5.3 Mediumautomation-gateway-proxy-serverRed HatUnbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service5.3 Mediumautomation-gateway-proxy-serverRed HatQuadratic complexity in WordDecoder.DecodeHeader in mime7.5 Highautomation-gateway-proxy-serverRed HatInefficient candidate hostname parsing in crypto/x5096.5 Mediumautomation-gateway-proxy-serverRed HatAIOHTTP Vulnerable to Deserialization of Untrusted Data6.4 Mediumautomation-gateway-proxy-serverRed HatPyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed7.4 Highautomation-gateway-proxy-serverRed HatQuadratic string concatenation in consumePhrase in net/mail7.5 Highautomation-gateway-proxy-serverRed HatQuadratic string concatentation in consumeComment in net/mail7.5 Highautomation-gateway-proxy-serverRed HatCrash when handling long CNAME response in net7.5 Highautomation-gateway-proxy-serverRed HatAap-gateway: missing requestheaderstoremove allows mtls bypass via subject header spoofing8.2 Highautomation-gateway-proxy-serverRed HatAap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking8.3 Highautomation-gateway-proxy-serverRed Hat[DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"7.2 Highautomation-gateway-proxy-serverRed HatPillow is vulnerable to a FITS GZIP decompression bomb8.7 Highautomation-gateway-proxy-serverRed HatAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain4.8 Mediumautomation-gateway-proxy-serverRed HatAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF6.3 Mediumautomation-gateway-proxy-serverRed Hatcryptography has a buffer overflow if non-contiguous buffers were passed to APIs6.9 Mediumautomation-gateway-proxy-serverRed HatUnauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls7.5 Highautomation-gateway-proxy-serverRed HatTOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix6.4 Mediumautomation-gateway-proxy-serverRed HatUnexpected work during chain building in crypto/x5097.5 Highautomation-gateway-proxy-serverRed HatJWCrypto: JWE ZIP decompression bomb5.3 Mediumautomation-gateway-proxy-serverRed HatVite Affected by Arbitrary File Read via Vite Dev Server WebSocket8.2 Highautomation-gateway-proxy-serverRed Hatlodash vulnerable to Code Injection via `_.template` imports key names8.1 Highautomation-gateway-proxy-serverRed HatForge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)7.4 Highautomation-gateway-proxy-serverRed HatForge has signature forgery in Ed25519 due to missing S > L check7.5 Highautomation-gateway-proxy-serverRed HatForge has signature forgery in RSA-PKCS due to ASN.1 extra field7.5 Highautomation-gateway-proxy-serverRed HatForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input7.5 Highautomation-gateway-proxy-serverRed Hatpath-to-regexp vulnerable to Denial of Service via sequential optional groups7.5 Highautomation-gateway-proxy-serverRed Hatpyasn1 Vulnerable to Denial of Service via Unbounded Recursion7.5 Highautomation-gateway-proxy-serverRed HatpyOpenSSL DTLS cookie callback buffer overflow7.2 Highautomation-gateway-proxy-serverRed HatPyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)7.5 Highautomation-gateway-proxy-serverRed HatIncorrect parsing of IPv6 host literals in net/url7.5 Highautomation-gateway-proxy-serverRed HatPython-Markdown has an Uncaught Exception7.5 Highautomation-gateway-proxy-serverRed HatSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)7.5 Highautomation-gateway-proxy-serverRed Hatminimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions7.5 Highautomation-gateway-proxy-serverRed HatRollup 4 has Arbitrary File Write via Path Traversal8.8 Highautomation-gateway-proxy-serverRed Hatminimatch has a ReDoS via repeated wildcards with non-matching literal in pattern8.7 Highautomation-gateway-proxy-serverRed HatPillow has an out-of-bounds write when loading PSD images8.6 Highautomation-gateway-proxy-serverRed Hatajv has ReDoS when using `$data` option2.9 Lowautomation-gateway-proxy-serverRed Hatcryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves8.2 Highautomation-gateway-proxy-serverRed HatAxios affected by Denial of Service via __proto__ Key in mergeConfig7.5 Highautomation-gateway-proxy-serverRed HatPotential denial-of-service vulnerability via repeated headers when using ASGI7.5 High- Show moreLoading…