Advisories · Technology
Red Hat OpenShift Virtualization 4.
Every CVE that names Red Hat OpenShift Virtualization 4 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.5 High
Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection
- Red Hat Ansible Automation Platform 2.6
- Red Hat Ansible Automation Platform 2.7
- Code injection
- CVSS 6.5 Medium
Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume
- Red Hat OpenShift Virtualization 4
- Memory corruption
- CVSS 4.4 Medium
Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 10
- Path traversal
- CVSS 4.5 Medium
Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers
- Red Hat Hardened Images
- Red Hat Ansible Automation Platform 2
- Path traversal
- CVSS 7.7 High
Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone
- Red Hat Container Native Virtualization 4.14
- Red Hat Container Native Virtualization 4.16
- Broken access control
- CVSS 4.9 Medium
Virt-controller-rhel9: kubevirt: kubevirt: multus default-network annotation injection via unvalidated tenant networkname when externalnetresourceinjection is enabled
- Red Hat OpenShift Virtualization 4
- CWE-20
- CVSS 6.5 Medium
Kubevirt: virt-handler-rhel9: kubevirt: virt-handler notify server trusts vmi identity from unauthenticated grpc request body
- Red Hat OpenShift Virtualization 4
- Authentication bypass
- CVSS 8.5 High
Virt-cdi-controller: unauthorized pvc cloning via dataimportcron
- Red Hat RHEL-9-CNV-4.19
- Red Hat OpenShift Virtualization 4
- Broken access control
- CVSS 4.8 Medium
Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri
- Red Hat libnbd
- Red Hat Enterprise Linux 10
- Command injection
- CVSS 7.8 High
Qemu-kvm: 'qemu-img info' leads to host file read/write
- Red Hat Advanced Virtualization for RHEL 8.2.1
- Red Hat Advanced Virtualization for RHEL 8.4.0.EUS
- Memory corruption
- CVSS 4.3 Medium
Cnv: information disclosure through the usage of vm-dump-metrics
- Red Hat OpenShift Virtualization 4
- Information disclosure
- CVSS 7.0 High
Ocp & fips mode
- openshift
- Red Hat OpenShift Serverless
- CWE-693