VDB
RHBA-2023%3A4315
RHBA-2023%3A4315
PUBLISHED
CVSS 9.100000381469727 CRITICAL
A flaw was found in the webpack package, which could allow a remote attacker to bypass security restrictions caused by the mishandling of the magic comment feature by the ImportParserPlugin.js. This flaw allows an attacker to gain access to the real global object by sending a specially-crafted request.
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:1614cd82205d8a0539afd1890b321e61d5c8a5db48c6c1426c8d0c4cc319fc39_amd64 as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:1614cd82205d8a0539afd1890b321e61d5c8a5db48c6c1426c8d0c4cc319fc39_amd64 |
| Red Hat | openshift-pipelines/pipelines-resolvers-rhel8@sha256:a308a9b735ecd36900c80d61e2c3bdbfbe9e8cf150349d30411049674e0c178d_ppc64le as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-resolvers-rhel8@sha256:a308a9b735ecd36900c80d61e2c3bdbfbe9e8cf150349d30411049674e0c178d_ppc64le |
| Red Hat | openshift-pipelines/pipelines-operator-bundle@sha256:6de05a4ccec9b50d30e05e21a0d62acae4cd61199ee53e8f8ca3a915230efa53_s390x as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-operator-bundle@sha256:6de05a4ccec9b50d30e05e21a0d62acae4cd61199ee53e8f8ca3a915230efa53_s390x |
| Red Hat | openshift-pipelines/pipelines-imagedigestexporter-rhel8@sha256:6924d00bd23e985158c7fc4e2d07eb6511d77db23dd858b707e9c1528b2eb8a1_ppc64le as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-imagedigestexporter-rhel8@sha256:6924d00bd23e985158c7fc4e2d07eb6511d77db23dd858b707e9c1528b2eb8a1_ppc64le |
| Red Hat | openshift-pipelines/pipelines-triggers-eventlistenersink-rhel8@sha256:c6f7fbf0dc9ccfe65774db3a9ab8008ec092a2e1db9b8995535d88825c9d8f8a_arm64 as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-triggers-eventlistenersink-rhel8@sha256:c6f7fbf0dc9ccfe65774db3a9ab8008ec092a2e1db9b8995535d88825c9d8f8a_arm64 |
| Red Hat | openshift-pipelines/pipelines-imagedigestexporter-rhel8@sha256:842a7f219c10692718f519ab36c4cd71589c2a66c5049d4f16ffd31d1c898ea1_amd64 as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-imagedigestexporter-rhel8@sha256:842a7f219c10692718f519ab36c4cd71589c2a66c5049d4f16ffd31d1c898ea1_amd64 |
| Red Hat | openshift-pipelines/pipelines-triggers-eventlistenersink-rhel8@sha256:afd9ab1230afc902daaab786a5f9465bfc994b12a30275be10e63a683d0ff070_s390x as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-triggers-eventlistenersink-rhel8@sha256:afd9ab1230afc902daaab786a5f9465bfc994b12a30275be10e63a683d0ff070_s390x |
| Red Hat | openshift-pipelines/pipelines-operator-bundle@sha256:9382f939bdad6871a36d243de2648d76a7d8647c475b89a531c354ba99878acd_arm64 as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-operator-bundle@sha256:9382f939bdad6871a36d243de2648d76a7d8647c475b89a531c354ba99878acd_arm64 |
| Red Hat | openshift-pipelines/pipelines-triggers-webhook-rhel8@sha256:4f3e66888b6acba5a002c43ba6dcd6c6644866d087c74152428311ca669403a5_arm64 as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-triggers-webhook-rhel8@sha256:4f3e66888b6acba5a002c43ba6dcd6c6644866d087c74152428311ca669403a5_arm64 |
| Red Hat | openshift-pipelines/pipelines-entrypoint-rhel8@sha256:e16c91df04e3fa8c9285c87153720979c7bc828840dfc17ccfff45ccc3f9aeff_ppc64le as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-entrypoint-rhel8@sha256:e16c91df04e3fa8c9285c87153720979c7bc828840dfc17ccfff45ccc3f9aeff_ppc64le |
| Red Hat | openshift-pipelines/pipelines-pipelines-as-code-rhel8@sha256:87188b472c5c5cb37b242b76fd11c788490b813a3fc236fb3a401c59c6315baf_ppc64le as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-pipelines-as-code-rhel8@sha256:87188b472c5c5cb37b242b76fd11c788490b813a3fc236fb3a401c59c6315baf_ppc64le |
| Red Hat | openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:f8fc4d1876a5c7898cc311acb513f9380b170f1d9e61711c6e33c998f0a431fe_ppc64le as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-serve-tkn-cli-rhel8@sha256:f8fc4d1876a5c7898cc311acb513f9380b170f1d9e61711c6e33c998f0a431fe_ppc64le |
| Red Hat | openshift-pipelines/pipelines-nop-rhel8@sha256:6a559fd5c1e4ab31263e7d531f94bd90cb3256a17a848a985e04e830bcccd9bd_ppc64le as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-nop-rhel8@sha256:6a559fd5c1e4ab31263e7d531f94bd90cb3256a17a848a985e04e830bcccd9bd_ppc64le |
| Red Hat | openshift-pipelines/pipelines-workingdirinit-rhel8@sha256:ad71b7d527db5256300493e24956f3e0e0f47328011f39854ecc35edb7484e83_arm64 as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-workingdirinit-rhel8@sha256:ad71b7d527db5256300493e24956f3e0e0f47328011f39854ecc35edb7484e83_arm64 |
| Red Hat | openshift-pipelines/pipelines-pipelines-as-code-rhel8@sha256:f3330941844e72985d4c509acf48d23ef5eb1c6776ca8c6d21d00661c8685996_s390x as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-pipelines-as-code-rhel8@sha256:f3330941844e72985d4c509acf48d23ef5eb1c6776ca8c6d21d00661c8685996_s390x |
| Red Hat | openshift-pipelines/pipelines-hub-ui-rhel8@sha256:b5357218a05523eecd95606e84dcaad47f161b5e1876eacccb31b7fc206dbad9_amd64 as a component of OpenShift Pipelines version 1.10 for RHEL 8 | * |
| Red Hat | openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:caaf9e8cfc61b9529b8a3484f9fbd9dae29407c2efbae5e67101a9666fc4dca1_s390x as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-operator-webhook-rhel8@sha256:caaf9e8cfc61b9529b8a3484f9fbd9dae29407c2efbae5e67101a9666fc4dca1_s390x |
| Red Hat | openshift-pipelines/pipelines-triggers-eventlistenersink-rhel8@sha256:8e0a06b705c77dfccf8e750823b52d9e4a9331451420ac6f0b1430f780179d94_ppc64le as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-triggers-eventlistenersink-rhel8@sha256:8e0a06b705c77dfccf8e750823b52d9e4a9331451420ac6f0b1430f780179d94_ppc64le |
| Red Hat | openshift-pipelines/pipelines-hub-db-migration-rhel8@sha256:2f3a6019dc4f5199908b4409cc654eb51642a4ac8c0d704d9e4603286c1159fb_s390x as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-hub-db-migration-rhel8@sha256:2f3a6019dc4f5199908b4409cc654eb51642a4ac8c0d704d9e4603286c1159fb_s390x |
| Red Hat | openshift-pipelines/pipelines-nop-rhel8@sha256:badcbdec5e7bd70436f10a40d9f4a30bcb9be8d81969a5752fe68fc298df3a07_amd64 as a component of OpenShift Pipelines version 1.10 for RHEL 8 | openshift-pipelines/pipelines-nop-rhel8@sha256:badcbdec5e7bd70436f10a40d9f4a30bcb9be8d81969a5752fe68fc298df3a07_amd64 |
…and 76 more
Timeline
- Jul 27, 2023 CVE Published
- Mar 21, 2026 CVE Updated
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHBA-2023:4315 advisory
- https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html/cicd/pipelines#release-notes-1-10-5_op-release-notes advisory
- https://docs.openshift.com/container-platform/4.13/cicd/pipelines/op-release-notes.html#release-notes-1-10-5_op-release-notes advisory
- https://issues.redhat.com/browse/SRVKP-3302 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhba-2023_4315.json advisory
- https://access.redhat.com/security/cve/CVE-2023-28154 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2179227 issue
- https://www.cve.org/CVERecord?id=CVE-2023-28154 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-28154 advisory
- https://github.com/advisories/GHSA-hc6q-2mpp-qw7j advisory