Red Hat Updates OpenShift Data Foundation to Fix Node.js Dependency Flaws
Vulnerability Disclosure · 14 sources · Updated 2mo ago · First seen Jul 1, 2024
Red Hat released Important updates for Red Hat OpenShift Data Foundation (ODF) 4.14.18 and 4.15.14 on Red Hat Enterprise Linux 9, delivering refreshed container images and upgrading Ceph to RHCEPH-7.1z4. The updates affect x86_64, aarch64, ppc64le, and s390x deployments and also resolve an MDSCacheUsageHigh alert issue in the 4.15 stream.
The releases remediate vulnerabilities in bundled dependencies, including CVE-2024-39249, a regular-expression denial-of-service flaw in Node.js async autoinject; CVE-2024-29041, which can let malformed URLs bypass Express redirect allowlists; and CVE-2024-29180, a webpack-dev-middleware path-traversal issue that could disclose files. The advisories also address cross-site scripting, prototype-pollution, file-disclosure, and additional denial-of-service and memory-consumption flaws; Red Hat advises customers to apply applicable prior errata before upgrading.
