Advisories · Technology
Red Hat OpenShift Dev Spaces.
Every CVE that names Red Hat OpenShift Dev Spaces among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.7 High
Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw
- Red Hat Exploit Intelligence
- Red Hat OpenShift Serverless
- Broken access control
- CVSS 3.3 Low
Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers
- Red Hat Confidential Compute Attestation
- Red Hat DPU kit for NVIDIA
- Denial of service
- CVSS 9.3 CriticalCritical · CVSS 9+
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose
- Red Hat Build of Podman Desktop
- Red Hat Certification Program for Red Hat Enterprise Linux 9
- Path traversal
- CVSS 3.6 Low
Cockpit: cockpit: unauthorized modification of login records via integer overflow
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Memory corruption
- CVSS 5.9 Medium
Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Denial of service
- CVSS 7.5 High
Cockpit: cockpit: denial of service via unbounded connection thread spawning
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10
- Denial of service
- CVSS 5.5 Medium
Podman: arbitrary file write when importing oci archive
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9
- CWE-277
- CVSS 4.4 Medium
Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 10
- Path traversal
- CVSS 4.5 Medium
Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers
- Red Hat Hardened Images
- Red Hat Ansible Automation Platform 2
- Path traversal
- CVSS 7.5 High
Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Denial of service
- CVSS 6.4 Medium
Codeready-ws: privilege escalation via excessive /etc/passwd permissions
- Red Hat OpenShift Dev Spaces
- Broken access control