Redhat
Redhat Openshift Container Platform FOR Power: vulnerabilidades y CVE
Redhat Openshift Container Platform FOR Power tiene 23 vulnerabilidades publicadas, 2 de ellas en los últimos 12 meses. 1 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE23
Últimos 12 meses2
Críticas1
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2019-0211 | Alta (7.8) | 65% | ⚠ Explotación activa | 8 abr 2019 | In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter)… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-4424 | Alta (7.5) | 1.1% | — | 19 mar 2026 | A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression… |
| CVE-2025-13601 | Alta (7.7) | 0.32% | — | 26 nov 2025 | A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable… |
| CVE-2025-6021 | Alta (7.5) | 1.4% | — | 12 jun 2025 | A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when… |
| CVE-2024-9676 | Media (6.5) | 1.3% | — | 15 oct 2024 | A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill… |
| CVE-2024-8883 | Media (6.1) | 2.1% | — | 19 sept 2024 | A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive… |
| CVE-2024-4629 | Media (6.5) | 0.79% | — | 3 sept 2024 | A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed… |
| CVE-2024-1132 | Alta (8.1) | 1.6% | — | 17 abr 2024 | A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive… |
| CVE-2024-1725 | Media (6.5) | 0.63% | — | 7 mar 2024 | A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a… |
| CVE-2024-1635 | Alta (7.5) | 4.6% | — | 19 feb 2024 | A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and… |
| CVE-2023-6291 | Alta (7.1) | 0.95% | — | 26 ene 2024 | A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible… |
| CVE-2023-2585 | Alta (8.1) | 0.69% | — | 21 dic 2023 | Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin… |
| CVE-2023-6134 | Media (5.4) | 1.3% | — | 14 dic 2023 | A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to… |
| CVE-2023-6563 | Alta (7.7) | 1.2% | — | 14 dic 2023 | An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an… |
| CVE-2023-5625 | Alta (7.5) | 0.80% | — | 1 nov 2023 | A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419 not being applied for all builds of all products. |
| CVE-2023-3223 | Alta (7.5) | 2.7% | — | 27 sept 2023 | A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If… |
| CVE-2022-4318 | Alta (7.8) | 0.29% | — | 25 sept 2023 | A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. |
| CVE-2022-4039 | Crítica (9.8) | 0.79% | — | 22 sept 2023 | A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code… |
| CVE-2022-3916 | Media (6.8) | 0.95% | — | 20 sept 2023 | A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of… |
| CVE-2023-1108 | Alta (7.5) | 1.8% | — | 14 sept 2023 | A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. |
| CVE-2022-4361 | Media (6.1) | 0.63% | — | 7 jul 2023 | Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by… |
| CVE-2023-3089 | Alta (7.5) | 0.52% | — | 5 jul 2023 | A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated. |
| CVE-2023-0056 | Media (6.5) | 1.8% | — | 23 mar 2023 | An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an… |
| CVE-2019-0211 | Alta (7.8) | 65% | ⚠ Explotación activa | 8 abr 2019 | In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter)… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.
Otros productos de Redhat
Enterprise Linux · 1937Enterprise Linux Desktop · 1928Enterprise Linux Server · 1891Enterprise Linux Workstation · 1845Enterprise Linux Server AUS · 1059Enterprise Linux EUS · 787Enterprise Linux Server TUS · 768Enterprise Linux Server EUS · 622Openshift Container Platform · 328Jboss Enterprise Application Platform · 244Satellite · 239Linux · 230