jaeger vulnerabilities (Red Hat)
33 vulnerabilities.
-
jaegerRed Hat shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token 9.2 Critical -
jaegerRed Hat OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning 6.3 Medium -
jaegerRed Hat OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full 6.3 Medium -
jaegerRed Hat nanoid: Integer Overflow or Wraparound 7.4 High -
jaegerRed Hat joserfc accepts JWT with padding, leading to JWT malleability 2.3 Low -
jaegerRed Hat nanoid Infinite Loop via Negative Size in non-secure module 8.2 High -
jaegerRed Hat nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom 8.2 High -
jaegerRed Hat Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable() 8.7 High -
jaegerRed Hat Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: TZlibTransport Decompression Size Limit 8.7 High -
jaegerRed Hat axios before 0.33.0 Prototype Pollution via Node HTTP adapter 8.3 High -
jaegerRed Hat axios 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 Denial of Service via maxDepth bypass 6.9 Medium -
jaegerRed Hat axios 0.28.0 before 1.18.0 Denial of Service via formDataToJSON 6.3 Medium -
jaegerRed Hat axios before 1.18.0 Prototype Pollution via auth subfields 6.3 Medium -
jaegerRed Hat axios 0.28.0 before 0.33.0 and 1.0.0 before 1.18.0 Denial of Service via formToJSON 6.3 Medium -
jaegerRed Hat Infinite loop on invalid input in golang.org/x/text 7.5 High -
jaegerRed Hat pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs 7.5 High -
jaegerRed Hat pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service 7.5 High -
jaegerRed Hat joserfc: HS256/HS384/HS512 verify accepts empty/nil HMAC key (cross-language sibling of CVE-2026-45363) 8.7 High -
jaegerRed Hat joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization 5.3 Medium -
jaegerRed Hat Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix 6.9 Medium -
jaegerRed Hat urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API 8.9 High -
jaegerRed Hat urllib3: Sensitive headers forwarded across origins in proxied low-level redirects 8.2 High -
jaegerRed Hat Prometheus: remote read endpoint allows denial of service via crafted snappy payload 7.5 High -
jaegerRed Hat Prometheus Azure AD remote write OAuth client secret exposed via config API 7.5 High -
jaegerRed Hat pyOpenSSL DTLS cookie callback buffer overflow 7.2 High -
jaegerRed Hat Infinite loop in JSON unmarshaling in google.golang.org/protobuf 7.5 High -
jaegerRed Hat Grafana world readable configuration files 5.5 Medium -
jaegerRed Hat jQuery has a potential XSS vulnerability 6.9 Medium -
jaegerRed Hat Insufficient Session Expiration in Kiali 7.0 High -
jaegerRed Hat Prototype Pollution in minimist 5.6 Medium -
jaegerRed Hat Improper Validation and Sanitization in url-parse 5.3 Medium -
jaegerRed Hat Kubernetes API Server JSON/YAML parsing vulnerable to resource exhaustion attack 7.5 High -
jaegerRed Hat Prototype Pollution in lodash 9.1 Critical