Red Hat CVEs
2,577 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-4418Libvirt: stack use-after-free in virnetclientioeventloop()
- CVE-2024-4029Wildfly: no timeout for eap management interface may lead to denial of service (dos)
- CVE-2024-4369Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azure
- CVE-2024-3154Cri-o: arbitrary command injection via pod annotation
- CVE-2024-3624Mirror-registry: database user and password stored in plain-text
- CVE-2024-3625Mirror-registry: redis password stored in plain-text
- CVE-2024-3623Mirror-registry: default database secret key stored in plain-text on initial configuration file
- CVE-2024-3622Mirror-registry: plain-text default csrf secret key
- CVE-2024-3508Bzip2: compressed content bomb leads to denial of service of bombastic api
- CVE-2024-2905Rpm-ostree: world-readable /etc/shadow file
- CVE-2024-2467Perl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)
- CVE-2024-1726Quarkus: security checks for some inherited endpoints performed after serialization in resteasy reactive may trigger a denial of service
- CVE-2024-1657Platform: insecure websocket used when interacting with eda server
- CVE-2024-1139Cluster-monitoring-operator: credentials leak
- CVE-2024-1102Jberet: jberet-core logging database credentials
- CVE-2024-0874Coredns: cd bit response is cached and served later
- CVE-2023-6787Keycloak: session hijacking via re-authentication
- CVE-2023-6717Keycloak: xss via assertion consumer service url in saml post-binding flow
- CVE-2023-6596Openshift: incomplete fix for rapid reset (cve-2023-44487/cve-2023-39325)
- CVE-2023-6544Keycloak: authorization bypass
- CVE-2023-6484Keycloak: log injection during webauthn authentication or registration
- CVE-2023-5675Quarkus: authorization flaw in quarkus resteasy reactive and classic when "quarkus.security.jaxrs.deny-unannotated-endpoints" or…
- CVE-2023-3597Keycloak: secondary factor bypass in step-up authentication
- CVE-2023-3758Sssd: race condition during authorization leads to gpo policies functioning inconsistently
- CVE-2024-2419Keycloak: path traversal in the redirect validation
- CVE-2024-1249Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos
- CVE-2024-1132Keycloak: path transversal in redirection validation
- CVE-2024-1481Freeipa: specially crafted http requests potentially lead to denial of service
- CVE-2024-3567Qemu-kvm: net: assertion failure in update_sctp_checksum()
- CVE-2023-6236Eap: oidc app attempting to access the second tenant, the user should be prompted to log