VDB
RHSA-2023%3A0794
RHSA-2023%3A0794
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | rhacm2/multicluster-observability-rhel8-operator@sha256:b329b846f30a02dc12a9af1006b32eae111fb9954dcf5ab4dd01142c73768291_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/multicluster-observability-rhel8-operator@sha256:b329b846f30a02dc12a9af1006b32eae111fb9954dcf5ab4dd01142c73768291_amd64 |
| Red Hat | rhacm2/acm-prometheus-rhel8@sha256:a31024043f963ee49a4eaab131085952742ef082e1c47cc676998d6dcf207a6f_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/acm-prometheus-rhel8@sha256:a31024043f963ee49a4eaab131085952742ef082e1c47cc676998d6dcf207a6f_s390x |
| Red Hat | rhacm2/multicluster-operators-application-rhel8@sha256:f25f468c8bf12bef03b9d38400da0b11a97360afb1b163571e32f8c66509d723_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/multicluster-operators-application-rhel8@sha256:f25f468c8bf12bef03b9d38400da0b11a97360afb1b163571e32f8c66509d723_s390x |
| Red Hat | rhacm2/prometheus-alertmanager-rhel8@sha256:d6b0e86f29dab6d89f6fa11c0784ff14cb1006760a16bee26336197f0cfae87a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/prometheus-alertmanager-rhel8@sha256:d6b0e86f29dab6d89f6fa11c0784ff14cb1006760a16bee26336197f0cfae87a_amd64 |
| Red Hat | rhacm2/memcached-exporter-rhel8@sha256:15b0ce69868674b0f82ae4baf3590a54e01d9ebcc9dbc793e31f923289f8a975_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/memcached-exporter-rhel8@sha256:15b0ce69868674b0f82ae4baf3590a54e01d9ebcc9dbc793e31f923289f8a975_s390x |
| Red Hat | rhacm2/observatorium-rhel8@sha256:a51c789ed04a4c127c017625883041acd522831e885637071d41bfe3eebbcb34_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/observatorium-rhel8@sha256:a51c789ed04a4c127c017625883041acd522831e885637071d41bfe3eebbcb34_amd64 |
| Red Hat | rhacm2/search-aggregator-rhel8@sha256:fd9b1ce2754afa36b13afcfd1f858d8349e7ce8da772581000f6d4cf022fa6a9_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/search-aggregator-rhel8@sha256:fd9b1ce2754afa36b13afcfd1f858d8349e7ce8da772581000f6d4cf022fa6a9_s390x |
| Red Hat | rhacm2/kube-rbac-proxy-rhel8@sha256:93e3fd0ed70942cd139f9aa69cb1b554a9f233bcd9dee4ae6677884d1761bdbd_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/kube-rbac-proxy-rhel8@sha256:93e3fd0ed70942cd139f9aa69cb1b554a9f233bcd9dee4ae6677884d1761bdbd_amd64 |
| Red Hat | rhacm2/kube-state-metrics-rhel8@sha256:ef2946f0a6f2d46dd41ddb074dc570ab34eadd1abfc4ed0ef71ab3821c3e5b06_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | * |
| Red Hat | rhacm2/rbac-query-proxy-rhel8@sha256:037f32bcb75c53c2ca3df761d42c8ac2c409c21cd52fb0f82b16a558cb465860_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/rbac-query-proxy-rhel8@sha256:037f32bcb75c53c2ca3df761d42c8ac2c409c21cd52fb0f82b16a558cb465860_ppc64le |
| Red Hat | rhacm2/submariner-addon-rhel8@sha256:48409b1f123491da843395bd3dcaa53798134243ec3c36f9236936e9f24f4b45_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/submariner-addon-rhel8@sha256:48409b1f123491da843395bd3dcaa53798134243ec3c36f9236936e9f24f4b45_arm64 |
| Red Hat | rhacm2/console-rhel8@sha256:9f39582360916bb4b1992246996e3aa74acc45df687532ac633c6ba2355bf312_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/console-rhel8@sha256:9f39582360916bb4b1992246996e3aa74acc45df687532ac633c6ba2355bf312_ppc64le |
| Red Hat | rhacm2/prometheus-rhel8@sha256:4780b0e407922afcff9fc07f5e6244c2b8b5c753bbb76fd0f447f272f18850f5_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/prometheus-rhel8@sha256:4780b0e407922afcff9fc07f5e6244c2b8b5c753bbb76fd0f447f272f18850f5_arm64 |
| Red Hat | rhacm2/thanos-receive-controller-rhel8@sha256:784ca9b2ee4f24802a3287a20dae0b8837b39ac253fcec1f8e0327ca2c2b8e43_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/thanos-receive-controller-rhel8@sha256:784ca9b2ee4f24802a3287a20dae0b8837b39ac253fcec1f8e0327ca2c2b8e43_ppc64le |
| Red Hat | rhacm2/prometheus-rhel8@sha256:7af598478e682a5e71ba687b6ff18410ef60702b4fa1d91ab27e9f639fc526e8_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | * |
| Red Hat | rhacm2/thanos-rhel8@sha256:c00bddf4726f69dd95b582de5a2ab5901c83176ba39b9d0232d274755b222cd1_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/thanos-rhel8@sha256:c00bddf4726f69dd95b582de5a2ab5901c83176ba39b9d0232d274755b222cd1_amd64 |
| Red Hat | rhacm2/memcached-rhel8@sha256:55869d62acabc78675fb3f926d45f6630f03ff380af76665eb36f3bd1ea17092_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/memcached-rhel8@sha256:55869d62acabc78675fb3f926d45f6630f03ff380af76665eb36f3bd1ea17092_ppc64le |
| Red Hat | rhacm2/multicloud-integrations-rhel8@sha256:c80b686c8b6c445142f11eae2e67b9159bd86bd68f3b979276854909459ddec6_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/multicloud-integrations-rhel8@sha256:c80b686c8b6c445142f11eae2e67b9159bd86bd68f3b979276854909459ddec6_arm64 |
| Red Hat | rhacm2/memcached-exporter-rhel8@sha256:ff7140ddb5a1fce8c1020c779ff1d5050f019d24f739d4925857ea6d5a4dd79a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | rhacm2/memcached-exporter-rhel8@sha256:ff7140ddb5a1fce8c1020c779ff1d5050f019d24f739d4925857ea6d5a4dd79a_amd64 |
| Red Hat | rhacm2/acm-operator-bundle@sha256:5974496dcb98fb518cff7eb1d65fa84b44ca498d6b226715815152e4da018257_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 | * |
…and 171 more
Timeline
- Feb 15, 2023 CVE Published
- Mar 19, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2023:0794 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2150323 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2153382 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0794.json advisory
- https://access.redhat.com/security/cve/CVE-2022-24999 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-24999 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-24999 advisory
- https://github.com/expressjs/express/releases/tag/4.17.3 advisory
- https://github.com/ljharb/qs/pull/428 advisory
- https://github.com/n8tz/CVE-2022-24999 advisory