Red Hat CVEs
2,580 CVEs and advisories name Red Hat as an affected vendor, 2 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2019-14846In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG
- CVE-2019-14845A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3.
- CVE-2019-14826A flaw was found in FreeIPA versions 4.5.0 and later.
- CVE-2019-10201It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures.
- CVE-2019-10199It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests.
- CVE-2019-3884A vulnerability exists in the garbage collection mechanism of atomic-openshift.
- CVE-2019-10165OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenS
- CVE-2019-10156A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of
- CVE-2018-16871A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20.
- CVE-2019-10138A flaw was discovered in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform.
- CVE-2019-10194Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions.
- CVE-2019-3889A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterpris
- CVE-2019-10135A flaw was found in the yaml.load() function in the osbs-client versions since 0.46 before 0.56.1.
- CVE-2019-10183Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interactio
- CVE-2019-10177A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user in
- CVE-2019-10159cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration
- CVE-2019-3875A vulnerability was found in keycloak before 6.0.2.
- CVE-2019-10157It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its back
- CVE-2019-3872It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x an
- CVE-2019-3888A vulnerability was found in Undertow web server before 2.0.21.
- CVE-2019-3873It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XM
- CVE-2019-3895An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director.
- CVE-2019-3894It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run th
- CVE-2019-3805A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate
- CVE-2019-3900An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packet
- CVE-2019-3868Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OI
- CVE-2019-3883In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads.
- CVE-2019-3891It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Can
- CVE-2019-3845A lack of access control was found in the message queues maintained by Satellite's QPID broker and used by katello-agent in versions before
- CVE-2017-3139A denial of service flaw was found in the way BIND handled DNSSEC validation.