Red Hat Security Advisory: OpenShift Container Platform 4.17.15 security and extras update

Important

A Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package for Node.js. Due to improper input sanitization, an attacker can increase CPU usage and crash the program with a large, specially crafted string.

CWE-1333 - Inefficient Regular Expression Complexity

A flaw was found in Express. This vulnerability allows untrusted code execution via passing untrusted user input to response.redirect(), even if the input is sanitized.

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

A flaw was found in the Send library. This vulnerability allows remote code execution via untrusted input passed to the SendStream.redirect() function.

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect().

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a denial of service (DoS).

CWE-1333 - Inefficient Regular Expression Complexity