Risk | High |
Patch available | YES |
Number of vulnerabilities | 30 |
CVE-ID | CVE-2020-24553 CVE-2019-20388 CVE-2020-24659 CVE-2020-13632 CVE-2020-13631 CVE-2020-13630 CVE-2020-10029 CVE-2020-9327 CVE-2020-7595 CVE-2020-6405 CVE-2020-1971 CVE-2020-1752 CVE-2020-1751 CVE-2020-1730 CVE-2019-20454 CVE-2019-20387 CVE-2020-28362 CVE-2019-20218 CVE-2019-19956 CVE-2019-19906 CVE-2019-19221 CVE-2019-16168 CVE-2019-15903 CVE-2019-14889 CVE-2019-13627 CVE-2019-13050 CVE-2019-5018 CVE-2018-20843 CVE-2020-28367 CVE-2020-28366 |
CWE-ID | CWE-79 CWE-401 CWE-476 CWE-264 CWE-416 CWE-121 CWE-835 CWE-125 CWE-787 CWE-399 CWE-20 CWE-369 CWE-78 CWE-310 CWE-297 CWE-611 CWE-94 |
Exploitation vector | Network |
Public exploit |
Public exploit code for vulnerability #8 is available. Public exploit code for vulnerability #11 is available. Public exploit code for vulnerability #22 is available. Public exploit code for vulnerability #23 is available. Public exploit code for vulnerability #27 is available. Public exploit code for vulnerability #28 is available. |
Vulnerable software Subscribe |
Red Hat OpenShift Serverless Server applications / Virtualization software |
Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains information about 30 vulnerabilities.
EUVDB-ID: #VU46580
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-24553
CWE-ID:
Exploit availability:
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU24487
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2019-20388
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in xmlSchemaPreRun in xmlschemas.c. A remote attacker can trigger a xmlSchemaValidateStream memory leak and perform denial of service attack.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU46295
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-24659
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure. A remote attacker can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU34080
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-13632
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in ext/fts3/fts3_snippet.c in SQLite. A local user can trigger denial of service conditions via a crafted matchinfo() query.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU34079
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-13631
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a local user to bypass certain security restrictions.
The vulnerability exists due an error in alter.c and build.c files in SQLite that allows a local user to rename a virtual table into a shadow table. A local user with permissions to create virtual tables can renamed them and gain unauthorized access to the fronted application.
Install updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU34077
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-13630
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the fts3EvalNextRow() function in ext/fts3/fts3.c. A remote attacker can pass specially crafted data to application, trigger a use-after-free error and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU26388
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-10029
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows an attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within "sysdeps/ieee754/ldbl-96/e_rem_pio2l.c" in GNU C Library (aka glibc or libc6). An attacker can pas specially crafted input to the application and trigger a stack-based buffer overflow.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system or denial of service conditions.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU25861
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2020-9327
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations. A remote attacker can perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU24488
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-7595
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop in xmlStringLenDecodeEntities in parser.c. A remote attacker can consume all available system resources and cause denial of service conditions in a certain end-of-file situation.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU24958
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-6405
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in SQLite. A remote attacker can pass specially crafted input to the application, trigger out-of-bounds read error and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU48896
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-1971
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack.
Install updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU26628
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-1752
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the glob() function in glibc in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username are affected by this issue. A local user can create a specially crafted path that, when processed by the glob() function, would potentially lead to arbitrary code execution.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU27033
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-1751
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error in the "backtrace" function when handling signal trampolines on PowerPC. A remote attacker can trigger out-of-bounds write and execute arbitrary code on the target system.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU26756
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-1730
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper resource management while cleaning the AES-CTR ciphers when closing the connection. A remote attacker can initiate a connection to the client and server that supports AES-CTR ciphers and close the connection before ciphers are initialized, triggering a denial of service condition (service crash). The vulnerability affects both client and server implementations.
Install updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU29116
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2019-20454
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to gain access to perform denial of service (DoS) attack.
The vulnerability exists due to a boundary condition in the "do_extuni_no_utf in pcre2_jit_compile.c" file when the pattern X is JIT compiled and used to match specially crafted subjects in non-UTF mode. A remote attacker can trigger out-of-bounds read error and crash the affected application.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU24490
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2019-20387
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to heap-based buffer over-read via a last schema whose length is less than the length of the input schema. A remote attacker can perform a denial of service attack.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU48480
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2020-28362
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in a number of math/big.Int methods (Div, Exp, DivMod, Quo, Rem, QuoRem, Mod, ModInverse, ModSqrt, Jacobi, and GCD). A remote attacker can pass large input data to the application, specifically as divisor or modulo argument larger than 3168 bits (on 32-bit architectures) or 6336 bits (on 64-bit architectures).
Install updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU24065
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2019-20218
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due memory leak within the selectExpander() function in select.c in SQLite, caused by incorrect exception handling, related to stack unwinding. A remote attacker can trigger with ability to modify the WITH SQL query can gain access to potentially sensitive information.
Install updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU24489
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2019-19956
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform DoS attack on the target system.
The vulnerability exists due memory leak in xmlParseBalancedChunkMemoryRecover in parser.c. A remote attacker can trigger a memory leak related to newDoc->oldNs and perform denial of service attack.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU23796
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2019-19906
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an out-of-bounds write error when processing LDAP queries within the _sasl_add_string() function in common.c file in cyrus-sasl. A remote non-authenticated attacker can create a specially LDAP request to the affected server, trigger off-by-one error in OpenLDAP implementation and crash the service.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU22931
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2019-19221
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition in "archive_wstring_append_from_mbs" in "archive_string.c" because of an incorrect "mbrtowc" or "mbtowc" call. A remote attacker can create a specially crafted archive file, trick the victim into opening it, trigger out-of-bounds read error and read contents of memory on the system.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU23188
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2019-16168
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a division by zero error within the whereLoopAddBtreeIndex in sqlite3.c due to improper input validation in the sqlite_stat1 sz field. A remote attacker can pass specially crafted data to the application, trigger division by zero error and crash the vulnerable application.
Install updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU21091
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2019-15903
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information or perform denial of service (DoS) attack.
The vulnerability exists due to a boundary error when processing XML documents within the expat library. A remote attacker can create a specially crafted XML file, pass it to the affected application, trigger out-of-bounds read error and read contents of memory on the system or crash the affected application.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU23508
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2019-14889
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to incorrect handling of the SCP command parameters when initiating the connection within the ssh_scp_new() function. A remote attacker can trick victim into using a specially crafted SCP command to connect to a remote SCP server and execute arbitrary commands on the target server with privileges of the current user.
Install updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU24721
Risk: Low
CVSSv3.1:
CVE-ID: CVE-2019-13627
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to perform timing attack.
The vulnerability exists due to an error within the libgcrypt20 cryptographic library. A remote attacker can perform ECDSA timing attack.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU20961
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2019-13050
CWE-ID:
Exploit availability:
DescriptionInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU18645
Risk: High
CVSSv3.1:
CVE-ID: CVE-2019-5018
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error within the window function functionality. A remote attacker can send a specially crafted SQL command to the application, trigger user-after-free error and execute arbitrary code on the system.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU18923
Risk: Medium
CVSSv3.1:
CVE-ID: CVE-2018-20843
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied XML input including XML names that contain a large number of colons. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.
Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU48479
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-28367
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation at build time when cgo is in use. A remote attacker can trick the victim to build a specially crafted application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
EUVDB-ID: #VU48478
Risk: High
CVSSv3.1:
CVE-ID: CVE-2020-28366
CWE-ID:
Exploit availability:
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation at build time when cgo is in use. A remote attacker can trick the victim into building a specially crafted application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Red Hat OpenShift Serverless: before 1.12.0
Fixed software versionsCPE2.3 External links
http://access.redhat.com/errata/RHSA-2021:0146
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?