VDB
RHSA-2023%3A0932
RHSA-2023%3A0932
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the express.js npm package of nodejs:14 module stream. Express.js Express is vulnerable to a denial of service caused by a prototype pollution flaw in qs. By adding or modifying properties of Object.prototype using a __proto__ or constructor payload, a remote attacker can cause a denial of service.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:50aae19f0750c0f35a905d81a758ff2c9dac6e410a3c6c0b76f9ef8ca112a64f_s390x as a component of RHOL 5.6 for RHEL 8 | openshift-logging/eventrouter-rhel8@sha256:50aae19f0750c0f35a905d81a758ff2c9dac6e410a3c6c0b76f9ef8ca112a64f_s390x |
| Red Hat | openshift-logging/logging-view-plugin-rhel8@sha256:b6bc0ab4ab8f31f81d7c5340918e69cad182b0a5e0669ef45f74f8810b1209f4_arm64 as a component of RHOL 5.6 for RHEL 8 | * |
| Red Hat | openshift-logging/opa-openshift-rhel8@sha256:a7e6a512ed9cde3ffb8c6214e3c8b697b175d9fe5aaa90ef17fe02cc3144c1a8_arm64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/opa-openshift-rhel8@sha256:a7e6a512ed9cde3ffb8c6214e3c8b697b175d9fe5aaa90ef17fe02cc3144c1a8_arm64 |
| Red Hat | openshift-logging/loki-rhel8-operator@sha256:16ddb250e456115e193392a08d322247ff0c8907e36abceab95b06d45b14b932_arm64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/loki-rhel8-operator@sha256:16ddb250e456115e193392a08d322247ff0c8907e36abceab95b06d45b14b932_arm64 |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:00995f237bb8d4ec4fbb7643225a6ba191894f98a269daffba942e5aa1226f73_ppc64le as a component of RHOL 5.6 for RHEL 8 | openshift-logging/elasticsearch-proxy-rhel8@sha256:00995f237bb8d4ec4fbb7643225a6ba191894f98a269daffba942e5aa1226f73_ppc64le |
| Red Hat | openshift-logging/vector-rhel8@sha256:2289ca68a0a07e537defe02132f6c0efa98368f0fc6fa44fcb75793e788a4c62_arm64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/vector-rhel8@sha256:2289ca68a0a07e537defe02132f6c0efa98368f0fc6fa44fcb75793e788a4c62_arm64 |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:a799a967668e9f45f31be3ee65f2ae6e61fe6dc0b583606f9c57b54c460bb1b6_amd64 as a component of RHOL 5.6 for RHEL 8 | * |
| Red Hat | openshift-logging/logging-view-plugin-rhel8@sha256:0cd5fe2598a0ea587e07d006ee4e8367e146cbc5ac2409e62b51d0d2eabcd9e7_ppc64le as a component of RHOL 5.6 for RHEL 8 | openshift-logging/logging-view-plugin-rhel8@sha256:0cd5fe2598a0ea587e07d006ee4e8367e146cbc5ac2409e62b51d0d2eabcd9e7_ppc64le |
| Red Hat | openshift-logging/cluster-logging-rhel8-operator@sha256:911b3a6a531023ec51a42aad73cb56c5710344568226eada7b7332f51bca4167_amd64 as a component of RHOL 5.6 for RHEL 8 | * |
| Red Hat | openshift-logging/logging-view-plugin-rhel8@sha256:592a51ddcf3546502cc21b82be6e3011c20c59ea3740431018b30907ee11e4ac_amd64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/logging-view-plugin-rhel8@sha256:592a51ddcf3546502cc21b82be6e3011c20c59ea3740431018b30907ee11e4ac_amd64 |
| Red Hat | openshift-logging/kibana6-rhel8@sha256:344d9cd561f7c62c6de21d2bac7662827edd530239e5607fa1eb6d1f8ceefdea_amd64 as a component of RHOL 5.6 for RHEL 8 | * |
| Red Hat | openshift-logging/elasticsearch-proxy-rhel8@sha256:0ef99a61c41e5ba3f013ee8c3cbe3c9455f9089140f0685af4e551fc411dc1d4_s390x as a component of RHOL 5.6 for RHEL 8 | openshift-logging/elasticsearch-proxy-rhel8@sha256:0ef99a61c41e5ba3f013ee8c3cbe3c9455f9089140f0685af4e551fc411dc1d4_s390x |
| Red Hat | openshift-logging/elasticsearch6-rhel8@sha256:f90bbb41cab58931aab34890b507d5fa2c2ae08b6320d4b35bd367f5dabd8f50_s390x as a component of RHOL 5.6 for RHEL 8 | * |
| Red Hat | openshift-logging/loki-operator-bundle@sha256:2e1df5346272bcfa8b8d0280df69fa648a0d16516d0b2addb3a12ec14906f4d0_amd64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/loki-operator-bundle@sha256:2e1df5346272bcfa8b8d0280df69fa648a0d16516d0b2addb3a12ec14906f4d0_amd64 |
| Red Hat | openshift-logging/fluentd-rhel8@sha256:f6b065eded5ec8c80c22a49ca37453dca681f74f8851490a178d813c77f27d62_ppc64le as a component of RHOL 5.6 for RHEL 8 | openshift-logging/fluentd-rhel8@sha256:f6b065eded5ec8c80c22a49ca37453dca681f74f8851490a178d813c77f27d62_ppc64le |
| Red Hat | openshift-logging/lokistack-gateway-rhel8@sha256:967d139924314bd44373058ff26ceda4193223936f2528712d3144aeb4785704_arm64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/lokistack-gateway-rhel8@sha256:967d139924314bd44373058ff26ceda4193223936f2528712d3144aeb4785704_arm64 |
| Red Hat | openshift-logging/lokistack-gateway-rhel8@sha256:e089e8dd44785e6b54296f26c2ea3740841d0b024fc38283c372e3237734f07e_s390x as a component of RHOL 5.6 for RHEL 8 | openshift-logging/lokistack-gateway-rhel8@sha256:e089e8dd44785e6b54296f26c2ea3740841d0b024fc38283c372e3237734f07e_s390x |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:e59f049fac9cdbcdb695efc84d014fee9ed6d13c64ec2e8818fd619aa14dbe1d_amd64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/eventrouter-rhel8@sha256:e59f049fac9cdbcdb695efc84d014fee9ed6d13c64ec2e8818fd619aa14dbe1d_amd64 |
| Red Hat | openshift-logging/fluentd-rhel8@sha256:eb1994e66ed00564f8dfddcb7b6b3276ef4eaa798099c61b7eea6c803e329e35_s390x as a component of RHOL 5.6 for RHEL 8 | openshift-logging/fluentd-rhel8@sha256:eb1994e66ed00564f8dfddcb7b6b3276ef4eaa798099c61b7eea6c803e329e35_s390x |
| Red Hat | openshift-logging/eventrouter-rhel8@sha256:e59f049fac9cdbcdb695efc84d014fee9ed6d13c64ec2e8818fd619aa14dbe1d_amd64 as a component of RHOL 5.6 for RHEL 8 | openshift-logging/eventrouter-rhel8@sha256:e59f049fac9cdbcdb695efc84d014fee9ed6d13c64ec2e8818fd619aa14dbe1d_amd64 |
…and 106 more
Timeline
- Mar 8, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:0932 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2150323 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2161274 issue
- https://issues.redhat.com/browse/LOG-3717 advisory
- https://issues.redhat.com/browse/LOG-3729 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0932.json advisory
- https://access.redhat.com/security/cve/CVE-2022-24999 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-24999 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-24999 advisory
- https://github.com/expressjs/express/releases/tag/4.17.3 advisory
- https://github.com/ljharb/qs/pull/428 advisory
- https://github.com/n8tz/CVE-2022-24999 advisory
- https://access.redhat.com/security/cve/CVE-2022-41717 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-41717 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-41717 advisory
- https://go.dev/cl/455635 advisory
- https://go.dev/cl/455717 advisory
- https://go.dev/issue/56350 advisory
- https://groups.google.com/g/golang-announce/c/L_3rmdT0BMU/m/yZDrXjIiBQAJ advisory
…and 1 more