Advisories · Technology
Red Hat OpenShift Update Service.
Every CVE that names Red Hat OpenShift Update Service among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.2 Medium
Quay: ssrf via build archive_url in quay build api
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Server-side request forgery (SSRF)
- CVSS 5.9 Medium
Quay: unauthenticated exported logs download in quay
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Authentication bypass
- CVSS 5.9 Medium
Quay: stripe webhook accepts forged events without signature verification in quay
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Weak cryptography or TLS
- CVSS 6.5 Medium
Quay: unauthenticated secscan notification endpoint in quay when psk is unset
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Authentication bypass
- CVSS 5.3 Medium
Quay: repository notification uuid idor in quay api
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Broken access control
- CVSS 4.8 Medium
Quay: ldap referral filter injection in quay external ldap authentication
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Other injection
- CVSS 5.4 Medium
Quay: jwt claim validation bypasses in quay federated robot and sso authentication
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Authentication bypass
- CVSS 5.5 Medium
Quay: ssrf in red hat quay notification webhooks (slack/generic)
- Red Hat OpenShift Update Service
- Red Hat Quay 3
- Server-side request forgery (SSRF)
- CVSS 6.4 Medium
Osus-operator: privilege escalation via excessive /etc/passwd permissions
- Red Hat OpenShift Update Service
- Broken access control