RHSA-2021:4902MediumCVSS 9.8
Red Hat Security Advisory: ACS 3.67 security and enhancement update
🔗 CVE IDs covered (7)
📋 Description
CVE-2020-27304 — civetweb: directory traversal when using the built-in example HTTP form-based file upload mechanism via the mg_handle_form_request API CVE-2021-3749 — nodejs-axios: Regular expression denial of service in trim function CVE-2021-3801 — nodejs-prismjs: ReDoS vulnerability CVE-2021-23343 — nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe CVE-2021-29923 — golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet CVE-2021-32690 — helm: information disclosure vulnerability CVE-2021-39293 — golang: archive/zip: malformed archive may cause panic or memory exhaustion (incomplete fix of CVE-2021-33196)
🔗 References (10)
- selfhttps://access.redhat.com/errata/RHSA-2021:4902
- externalhttps://access.redhat.com/security/updates/classification/#moderate
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1956818
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1978144
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1992006
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1999784
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2005445
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2006044
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=2016640
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4902.json