Red Hat CVEs
2,577 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-9355Golang-fips: golang fips zeroed buffer
- CVE-2024-7259Ovirt-engine: potential exposure of cleartext provider passwords via web ui
- CVE-2024-8612Qemu-kvm: information leak in virtio devices
- CVE-2024-8883Keycloak: vulnerable redirect uri validation results in open redirec
- CVE-2024-8698Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak
- CVE-2024-8354Qemu-kvm: usb: assertion failure in usb_ep_get()
- CVE-2024-45770Pcp: pmpost symlink attack allows escalating pcp to root user
- CVE-2024-45769Pcp: pmcd heap corruption through metric pmstore operations
- CVE-2024-8939Vllm: denials of service in vllm json web api
- CVE-2024-8768Vllm: a completions api request with an empty prompt will crash the vllm api server.
- CVE-2024-45496Openshift-controller-manager: elevated build pods can lead to node compromise in openshift
- CVE-2024-7387Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy
- CVE-2024-8775Ansible-core: exposure of sensitive information in ansible vault files due to improper logging
- CVE-2024-6840Automation-controller: gain access to the k8s api server via job execution with container group
- CVE-2023-6841Keycloak: amount of attributes per object is not limited and it may lead to dos
- CVE-2024-8443Libopensc: heap buffer overflow in openpgp driver when generating key
- CVE-2024-7341Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
- CVE-2024-7318Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity
- CVE-2024-7260Keycloak-core: open redirect on account page
- CVE-2024-8509Migration toolkit for virtualization: forklift-controller: empty bearer token may perform authentication
- CVE-2024-8445389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)
- CVE-2024-8418Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service
- CVE-2024-7923Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
- CVE-2024-7012Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-45620Libopensc: incorrect handling of the length of buffers or files in pkcs15init
- CVE-2024-45619Libopensc: incorrect handling length of buffers or files in libopensc
- CVE-2024-45618Libopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15init
- CVE-2024-45617Libopensc: uninitialized values after incorrect or missing checking return values of functions in libopensc
- CVE-2024-45616Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc
- CVE-2024-45615Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init