Red Hat Container Native Virtualization 4.15 vulnerabilities
5 known vulnerabilities in Red Hat Container Native Virtualization 4.15 from Red Hat. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Red Hat Container Native Virtualization 4.12: Improper Limitation of a Pathname to a Restricted Directory
A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These so
- 7.3 High severity
Red Hat Container Native Virtualization 4.12: UNIX Symbolic Link (Symlink) Following
A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. W
- 7.7 High severity
axios: Improper Control of Generation of Code
Axios is a promise based HTTP client for the browser and Node.js. From 0.19.0 to before 0.31.1 and 1.15.2, Axios contains prototype-pollution gadgets in request config processing. If another vulnerability in the same JavaScript process has already polluted Obj
- 9.9 Critical severity
Red Hat Container Native Virtualization 4.12: Improper Link Resolution Before File Access
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing
- 9.1 Critical severity
axios: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalat