Skip to contentRed Hat vulnerabilities
Products
Show 140 moreShow less
Newest
- gnu nano, red hat enterprise linux 10, enterprise linux 6 +7 more +9 moreNano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned fileCVE-2024-5742Fix available6.7 Medium
- clusterlabs booth, red hat enterprise linux 10, enterprise linux 7 +17 more +19 moreBooth: specially crafted hash can lead to invalid hmac being accepted by booth serverCVE-2024-3049Fix available5.9 Medium
- red hat logging subsystem for red hat openshift, openshift container platform 4.12, openshift container platform 4.13 +7 more +9 moreOpenshift/telemeter: iss check during jwt authentication can be bypassedCVE-2024-50377.5 High
- katello project katello, red hat satellite 6, redhat satellite +2 moreKatello: potential cross-site scripting exploit in uiCVE-2024-48124.8 Medium
- red hat satellite 6, redhat satellite +1 moreForeman-installer: candlepin database password being leaked to local users via the process listCVE-2024-37166.2 Medium
- kubernetes cri-o, red hat enterprise linux 8, enterprise linux 9 +8 more +10 moreCri-o: malicious container can create symlink on hostCVE-2024-5154Fix available8.1 High
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +5 more +7 moreKeycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookieCVE-2024-4540Fix available7.5 High
- red hat enterprise linux 10, enterprise linux 7 extended lifecycle support, enterprise linux 8 +11 more +13 moreLibndp: buffer overflow in route information length fieldCVE-2024-5564Fix available8.1 High
- red hat directory server 11.5 e4s for rhel 8, directory server 11.7 for rhel 8, directory server 11.8 for rhel 8 +10 more +12 more389-ds-base: potential denial of service via specially crafted kerberos as-req requestCVE-2024-3657Fix available7.5 High
- red hat directory server 11.5 e4s for rhel 8, directory server 11.8 for rhel 8, directory server 11.9 for rhel 8 +7 more +9 more389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.cCVE-2024-2199Fix available5.7 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 moreGnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificateCVE-2024-5148Fix available7.5 High
- red hat advanced cluster management for kubernetes 2, openshift data foundation 4.20, rhodf-4.16-rhel-9 +2 moreSubmariner-operator: rbac permissions can allow for the spread of node compromisesCVE-2024-5042Fix available6.6 Medium
- red hat satellite 6.15 for rhel 8Foreman: host ssh key not being checked in remote executionCVE-2024-4871Fix available6.8 Medium
- red hat openstack platform 16.2, openstack platform 17.1 for rhel 9 +1 moreRhosp-director: cleartext passwords exposed in logsCVE-2024-4840Fix available5.5 Medium
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +2 more +4 moreQemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crashCVE-2024-4693Fix available5.5 Medium
- red hat multicluster engine for kubernetes, oadp-1.3-rhel-9, openshift developer tools and services +28 more +30 moreContainers/image: digest type does not guarantee valid typeCVE-2024-3727Fix available8.3 High
- red hat openstack platform 16.1, openstack platform 16.2, openstack platform 17.1 for rhel 9 +1 more +3 moreEtcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platformCVE-2024-44387.5 High
- red hat openstack platform 16.1, openstack platform 16.2, openstack platform 17.1 +1 more +3 moreEtcd: incomplete fix for cve-2021-44716 in openstack platformCVE-2024-44377.5 High
- red hat openstack platform 16.1, openstack platform 16.2, openstack platform 17.1 +1 more +3 moreEtcd: incomplete fix for cve-2022-41723 in openstack platformCVE-2024-44367.5 High
- red hat enterprise linux 6, enterprise linux 7, enterprise linux 8 +3 more +5 moreLibvirt: stack use-after-free in virnetclientioeventloop()CVE-2024-4418Fix available6.2 Medium
- red hat build of keycloak, data grid 8, fuse 7 +11 more +13 moreWildfly: no timeout for eap management interface may lead to denial of service (dos)CVE-2024-40294.1 Medium
- red hat openshift container platform 4.14, openshift container platform 4.15 +1 moreCluster-image-registry-operator: exposes a secret via env variable in pod definition on azureCVE-2024-43696.8 Medium
- red hat openshift container platform 3.11, openshift container platform 4.12, openshift container platform 4.13 +2 more +4 moreCri-o: arbitrary command injection via pod annotationCVE-2024-3154Fix available7.2 High
- red hat mirror registry for red hat openshiftMirror-registry: redis password stored in plain-textCVE-2024-36257.3 High
- red hat mirror registry for red hat openshiftMirror-registry: database user and password stored in plain-textCVE-2024-36247.3 High
- red hat mirror registry for red hat openshift, redhat mirror registry +1 moreMirror-registry: default database secret key stored in plain-text on initial configuration fileCVE-2024-36236.5 Medium
- red hat mirror registry for red hat openshift, redhat mirror registry +1 moreMirror-registry: plain-text default csrf secret keyCVE-2024-36228.8 High
- red hat trusted profile analyzerBzip2: compressed content bomb leads to denial of service of bombastic apiCVE-2024-35084.3 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 moreRpm-ostree: world-readable /etc/shadow fileCVE-2024-2905Fix available6.2 Medium
- redhat openssl, red hat enterprise linux 6, enterprise linux 7 +2 more +4 morePerl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)CVE-2024-2467Fix available5.9 Medium
- red hat build of quarkus, build of quarkus 3.2.11.final +1 moreQuarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of serviceCVE-2024-1726Fix available5.3 Medium
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9 +1 morePlatform: insecure websocket used when interacting with eda serverCVE-2024-16578.1 High
- red hat advanced cluster management for kubernetes 2, openshift container platform 3.11, openshift container platform 4.12 +3 more +5 moreCluster-monitoring-operator: credentials leakCVE-2024-11397.7 High
- jberet, red hat build of keycloak, data grid 8 +11 more +13 moreJberet: jberet-core logging database credentialsCVE-2024-1102Fix available6.5 Medium
- red hat logging subsystem for red hat openshift, advanced cluster management for kubernetes 2, openshift container platform 4.13 +3 more +5 moreCoredns: cd bit response is cached and served laterCVE-2024-0874Fix available5.3 Medium
- red hat openshift container platform 4, openshift container platform 4.11, openshift container platform 4.12 +2 moreOpenshift: incomplete fix for rapid reset (cve-2023-44487/cve-2023-39325)CVE-2023-65967.5 High
- red hat a-mq clients 2, cryostat 2, openshift serverless +9 more +11 moreQuarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or "quarkus.security.jaxrs.default-roles-allowed" properties are used.CVE-2023-5675Fix available6.5 Medium
- qemu, netapp hci compute node, red hat enterprise linux 6 +15 more +17 moreQemu: sdhci: heap buffer overflow in sdhci_write_dataport()CVE-2024-3447Fix available6.0 Medium
- fedoraproject sssd, fedora, red hat enterprise linux 6 +29 more +31 moreSssd: race condition during authorization leads to gpo policies functioning inconsistentlyCVE-2023-3758Fix available7.1 High
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7 +2 moreKeycloak: impersonation via logout token exchangeCVE-2023-0657Fix available3.4 Low
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.10 +2 more +4 moreKeycloak: session hijacking via re-authenticationCVE-2023-6787Fix available6.5 Medium
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7 +5 more +7 moreKeycloak: log injection during webauthn authentication or registrationCVE-2023-6484Fix available5.3 Medium
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7.6 for rhel 7 +4 more +6 moreKeycloak: authorization bypassCVE-2023-6544Fix available5.4 Medium
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +18 more +20 moreKeycloak: xss via assertion consumer service url in saml post-binding flowCVE-2023-6717Fix available6.0 Medium
- red hat build of keycloak 22, build of keycloak 22.0.10, rhsso 7.6.8 +2 moreKeycloak: secondary factor bypass in step-up authenticationCVE-2023-3597Fix available5.0 Medium
- red hat build of keycloak 22Keycloak: path traversal in the redirect validationCVE-2024-2419Fix available7.1 High
- red hat migration toolkit for applications 6, migration toolkit for applications 7, amq broker 7 +20 more +22 moreKeycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddosCVE-2024-1249Fix available7.4 High
- redhat keycloak, red hat migration toolkit for runtimes 1 on rhel 8, mta-6.2-rhel-9 +26 more +28 moreKeycloak: path transversal in redirection validationCVE-2024-1132Fix available8.1 High
- qemu, red hat enterprise linux 6, enterprise linux 7 +4 more +6 moreQemu-kvm: net: assertion failure in update_sctp_checksum()CVE-2024-3567Fix available5.5 Medium
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8, jboss enterprise application platform 8.0 for rhel 8 +2 more +4 moreEap: oidc app attempting to access the second tenant, the user should be prompted to logCVE-2023-6236Fix available7.3 High
- Show moreLoading…