VDB
RHSA-2021%3A4628
RHSA-2021%3A4628
PUBLISHED
CVSS 9.800000190734863 CRITICAL
A flaw was found in nodejs-handlebars. A missing check when getting prototype properties in the template function allows an attacker, who can provide untrusted handlebars templates, to execute arbitrary code in the javascript system (e.g. browser or server) when the template is compiled with the strict:true option. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-logging/kibana6-rhel8@sha256:df544a9f4d3b4ee72aa1f83479088d094fb85b6ebfa0f4cb0329b29f2a794900_s390x as a component of OpenShift Logging 5.1 | *, * |
| Red Hat | openshift-logging/cluster-logging-operator-bundle@sha256:8501f1121df861950d13535f20063c942ab3a880102aecef7bf93cfa2954a506_amd64 as a component of OpenShift Logging 5.1 | *, * |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:3f9d0b9723a2e8071433a8fb7feb2000108702229a4281b26a02b5a2e45da7b7_amd64 as a component of OpenShift Logging 5.1 | *, openshift-logging/eventrouter-rhel8@sha256:3f9d0b9723a2e8071433a8fb7feb2000108702229a4281b26a02b5a2e45da7b7_amd64 |
| Red Hat | openshift-logging/elasticsearch6-rhel8@sha256:b4e2e17de6d611f358c671bd16b768c7961675d125a693b518861cb1ac72e942_s390x as a component of OpenShift Logging 5.1 | *, openshift-logging/elasticsearch6-rhel8@sha256:b4e2e17de6d611f358c671bd16b768c7961675d125a693b518861cb1ac72e942_s390x |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:82f2130357fd0b161f5df871aac0bfa5ac51a62f5161727ffb13e0a56c20bf93_ppc64le as a component of OpenShift Logging 5.1 | *, * |
| Red Hat | openshift-logging/elasticsearch-rhel8-operator@sha256:815c7c0278017d894f3a059eb7ca721739229c37e8777e7e127bdf27fa471bba_ppc64le as a component of OpenShift Logging 5.1 | openshift-logging/elasticsearch-rhel8-operator@sha256:815c7c0278017d894f3a059eb7ca721739229c37e8777e7e127bdf27fa471bba_ppc64le, * |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:7177e4f15fff74e74005daa12410a9481e8e98021185391dab20b1d4af294f59_s390x as a component of OpenShift Logging 5.1 | *, * |
| Red Hat | openshift-logging/fluentd-rhel8@sha256:d6e5fd11b5846fe352b62d589413503f54f55689abd2118968aebe9eea7fc6e9_ppc64le as a component of OpenShift Logging 5.1 | *, openshift-logging/fluentd-rhel8@sha256:d6e5fd11b5846fe352b62d589413503f54f55689abd2118968aebe9eea7fc6e9_ppc64le |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:8af2047ad56faf9b704e54f93d7cca61bae34ace6946435ff6d82a5fe90a0884_ppc64le as a component of OpenShift Logging 5.1 | *, * |
| Red Hat | openshift-logging/elasticsearch6-rhel8@sha256:0b340bdd57d7a254db0b9bd875bae50619af6faf3686885a30720d0db57ac3e8_amd64 as a component of OpenShift Logging 5.1 | *, openshift-logging/elasticsearch6-rhel8@sha256:0b340bdd57d7a254db0b9bd875bae50619af6faf3686885a30720d0db57ac3e8_amd64 |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:f398a1bdd3fa678aa98a35d180005ba661f2a8ce4f17f4fe30415c284082b5b5_ppc64le as a component of OpenShift Logging 5.1 | openshift-logging/elasticsearch-proxy-rhel8@sha256:f398a1bdd3fa678aa98a35d180005ba661f2a8ce4f17f4fe30415c284082b5b5_ppc64le, * |
| Red Hat | openshift-logging/elasticsearch-rhel8-operator@sha256:d1bea109ca85e381f015e18f1ee6ee4eb5f7b8876903663aded66e581bfa7dda_s390x as a component of OpenShift Logging 5.1 | *, openshift-logging/elasticsearch-rhel8-operator@sha256:d1bea109ca85e381f015e18f1ee6ee4eb5f7b8876903663aded66e581bfa7dda_s390x |
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:5c8ab23b7f2a15d1433256fe6680c13b34dd4e123ce55bbceb5da2e0947098b0_s390x as a component of OpenShift Logging 5.1 | *, * |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:48d73be0d01a4913ec69b06b04ca330adaa09d6268c2bbfc5938a7d4995aeb66_s390x as a component of OpenShift Logging 5.1 | *, openshift-logging/elasticsearch-proxy-rhel8@sha256:48d73be0d01a4913ec69b06b04ca330adaa09d6268c2bbfc5938a7d4995aeb66_s390x |
| Red Hat | openshift-logging/fluentd-rhel8@sha256:7cbade1bc717c611aead08262449649b39f3a296274fbe77cfc40e4e2d7c41f8_s390x as a component of OpenShift Logging 5.1 | *, * |
| Red Hat | openshift-logging/elasticsearch-rhel8-operator@sha256:0655e77f05d362b0436c3f0fea41cec77ef6928291444d65e00a911c05a26063_amd64 as a component of OpenShift Logging 5.1 | *, openshift-logging/elasticsearch-rhel8-operator@sha256:0655e77f05d362b0436c3f0fea41cec77ef6928291444d65e00a911c05a26063_amd64 |
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:520d4aff85af992db19855a00adfc9328fff3c3ca79836f60fdaffc209a36089_amd64 as a component of OpenShift Logging 5.1 | *, openshift-logging/cluster-logging-rhel8-operator@sha256:520d4aff85af992db19855a00adfc9328fff3c3ca79836f60fdaffc209a36089_amd64 |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:07419114c8a894f9561e639a9af036ba57b808c20d8d5e04ffc4533e29a592c2_amd64 as a component of OpenShift Logging 5.1 | *, * |
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:ef2775e5c9c3d26d98221c679d55f8f07d0331803ab3ba53d51a1f64b71198e9_ppc64le as a component of OpenShift Logging 5.1 | *, openshift-logging/cluster-logging-rhel8-operator@sha256:ef2775e5c9c3d26d98221c679d55f8f07d0331803ab3ba53d51a1f64b71198e9_ppc64le |
| Red Hat | openshift-logging/elasticsearch-operator-bundle@sha256:ffac4aab09e1567ed8d25d8a401032a88538a23693390d74f404a6c46ca437ab_amd64 as a component of OpenShift Logging 5.1 | *, openshift-logging/elasticsearch-operator-bundle@sha256:ffac4aab09e1567ed8d25d8a401032a88538a23693390d74f404a6c46ca437ab_amd64 |
…and 3 more
Timeline
- Nov 17, 2021 CVE Published
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 14, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2021:4628 advisory
- https://access.redhat.com/security/updates/classification/#low advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1948761 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1956688 issue
- https://issues.redhat.com/browse/LOG-1858 advisory
- https://issues.redhat.com/browse/LOG-1917 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4628.json advisory
- https://access.redhat.com/security/cve/CVE-2021-23369 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-23369 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-23369 advisory
- https://access.redhat.com/security/cve/CVE-2021-23383 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-23383 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-23383 advisory