Red Hat Advanced Cluster Management for Kubernetes 2 vulnerabilities
52 known vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2 from Red Hat. 52 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.2 High severity
node-tar: Improper Limitation of a Pathname to a Restricted Directory
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a maliciou
- 7.0 High severity
cli: Incorrect Permission Assignment for Critical Resource
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on
- 9.1 Critical severity
react-router: Improper Limitation of a Pathname to a Restricted Directory
React Router is a router for React. In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/nod
- 7.5 High severity
nodemailer: Improper Check or Handling of Exceptional Conditions
A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the address parser.
- 7.5 High severity
nodemailer: Improper Validation of Syntactic Correctness of Input
A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes
- 9.6 Critical severity
Multicluster Global Hub: Embedded Malicious Code
Malicious code was inserted into the Nx (build system) package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credenti
- 8.2 High severity
Multicluster Engine for Kubernetes: Insecure Storage of Sensitive Information
A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be exposed in the ClusterProvision object after provisioning a VSphere cluster. Users with read access to
- 7.5 High severity
Red Hat Advanced Cluster Management for…: Incorrect Privilege Assignment
A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound
- 8.3 High severity
OADP-1.3-RHEL-9: Improper Validation of Integrity Check Value
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
- 7.7 High severity
Red Hat OpenShift Container Platform 4.12: Exposure of Sensitive Information to an Unauthorized Actor
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
- 7.5 High severity
kubernetes: Incorrect Authorization
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.
- 7.5 High severity
openshift: Weak Password Requirements
A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.