VDB
RHSA-2024%3A10236
RHSA-2024%3A10236
PUBLISHED
CVSS 9.800000190734863 CRITICAL
A vulnerability was found in the NPM IP Package. This flaw allows an attacker to perform arbitrary code execution and obtain sensitive information via the isPublic() function by inducing a Server-Side Request Forgery (SSRF) attack and obtaining access to normally inaccessible resources.
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | devspaces/udi-rhel8@sha256:538541d44c663c8dc78353ab6bf6f64d0ee124ec7ba7fbbe767ebe221f86a5fc_s390x as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/udi-rhel8@sha256:538541d44c663c8dc78353ab6bf6f64d0ee124ec7ba7fbbe767ebe221f86a5fc_s390x, devspaces/udi-rhel8@sha256:538541d44c663c8dc78353ab6bf6f64d0ee124ec7ba7fbbe767ebe221f86a5fc_s390x |
| Red Hat | devspaces/imagepuller-rhel8@sha256:a983f5c523406a811ebcefbf855e378dfb99356b529a5f0f6027b852a147ed53_s390x as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/imagepuller-rhel8@sha256:a983f5c523406a811ebcefbf855e378dfb99356b529a5f0f6027b852a147ed53_s390x |
| Red Hat | devspaces/pluginregistry-rhel8@sha256:a1c52cd0e68cbb12d3b80445631857fb95b7400db8c8ad092bda99493c56e913_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/pluginregistry-rhel8@sha256:a1c52cd0e68cbb12d3b80445631857fb95b7400db8c8ad092bda99493c56e913_ppc64le |
| Red Hat | devspaces/udi-rhel8@sha256:77a5001120df3d8890af1e3cfbb891767810b977c9d2a111c781564e992aea65_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/udi-rhel8@sha256:77a5001120df3d8890af1e3cfbb891767810b977c9d2a111c781564e992aea65_amd64, devspaces/udi-rhel8@sha256:77a5001120df3d8890af1e3cfbb891767810b977c9d2a111c781564e992aea65_amd64 |
| Red Hat | devspaces/server-rhel8@sha256:81e1327cdcd4af6c801db90e4ef998f6b4701a5b3a73464ae2448bc23c83e334_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/server-rhel8@sha256:81e1327cdcd4af6c801db90e4ef998f6b4701a5b3a73464ae2448bc23c83e334_ppc64le |
| Red Hat | devspaces/devspaces-operator-bundle@sha256:4918d11864a079f3c6bd3f5e39326c34eec2a528f64a4fe3b5f35d99507dbfe2_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/devspaces-operator-bundle@sha256:4918d11864a079f3c6bd3f5e39326c34eec2a528f64a4fe3b5f35d99507dbfe2_ppc64le, devspaces/devspaces-operator-bundle@sha256:4918d11864a079f3c6bd3f5e39326c34eec2a528f64a4fe3b5f35d99507dbfe2_ppc64le |
| Red Hat | devspaces/configbump-rhel8@sha256:175d0c7a1c89f6405528dbe16e7d5fe3efa2475b93182c7d7c0a5e0e15b3d292_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/configbump-rhel8@sha256:175d0c7a1c89f6405528dbe16e7d5fe3efa2475b93182c7d7c0a5e0e15b3d292_amd64 |
| Red Hat | devspaces/pluginregistry-rhel8@sha256:a1c52cd0e68cbb12d3b80445631857fb95b7400db8c8ad092bda99493c56e913_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/pluginregistry-rhel8@sha256:a1c52cd0e68cbb12d3b80445631857fb95b7400db8c8ad092bda99493c56e913_ppc64le |
| Red Hat | devspaces/devspaces-rhel8-operator@sha256:863213cda25827e6fc1d9167740587ccfcacf2dd0042e810d87193be8be5ae00_s390x as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/devspaces-rhel8-operator@sha256:863213cda25827e6fc1d9167740587ccfcacf2dd0042e810d87193be8be5ae00_s390x, devspaces/devspaces-rhel8-operator@sha256:863213cda25827e6fc1d9167740587ccfcacf2dd0042e810d87193be8be5ae00_s390x |
| Red Hat | devspaces/devspaces-rhel8-operator@sha256:25c5bbe58c746a3d4d41b90f04026728c001ab8e3dddf61523d0830b0097455b_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/devspaces-rhel8-operator@sha256:25c5bbe58c746a3d4d41b90f04026728c001ab8e3dddf61523d0830b0097455b_ppc64le |
| Red Hat | devspaces/machineexec-rhel8@sha256:d892d008651e973127665947e9ece200bca3294dbc147f4a02c09302dd18da91_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/machineexec-rhel8@sha256:d892d008651e973127665947e9ece200bca3294dbc147f4a02c09302dd18da91_amd64 |
| Red Hat | devspaces/pluginregistry-rhel8@sha256:be18a2a7149ccbf20657598d109858e24a1c950fc2e883e99eaa09d8326ba440_s390x as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/pluginregistry-rhel8@sha256:be18a2a7149ccbf20657598d109858e24a1c950fc2e883e99eaa09d8326ba440_s390x |
| Red Hat | devspaces/machineexec-rhel8@sha256:602db7874132ce8e37e4399a38e9e7806123071c33a13c2efacdfe5465f41147_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/machineexec-rhel8@sha256:602db7874132ce8e37e4399a38e9e7806123071c33a13c2efacdfe5465f41147_ppc64le |
| Red Hat | devspaces/code-rhel8@sha256:1661e168db3b442b9de9023fb55261c1549fd034f42ab0ab0b04ad4ec7394ec0_s390x as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/code-rhel8@sha256:1661e168db3b442b9de9023fb55261c1549fd034f42ab0ab0b04ad4ec7394ec0_s390x |
| Red Hat | devspaces/code-rhel8@sha256:1661e168db3b442b9de9023fb55261c1549fd034f42ab0ab0b04ad4ec7394ec0_s390x as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/code-rhel8@sha256:1661e168db3b442b9de9023fb55261c1549fd034f42ab0ab0b04ad4ec7394ec0_s390x |
| Red Hat | devspaces/dashboard-rhel8@sha256:95302249f869bd80308548a63683bb892ca40e876561fea204169f405bb220e7_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/dashboard-rhel8@sha256:95302249f869bd80308548a63683bb892ca40e876561fea204169f405bb220e7_amd64, devspaces/dashboard-rhel8@sha256:95302249f869bd80308548a63683bb892ca40e876561fea204169f405bb220e7_amd64 |
| Red Hat | devspaces/code-rhel8@sha256:2a4deccbc7b8c5bc53f2fde315ccd93e7f2c2022e9288f7a93ed642feb808dc1_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/code-rhel8@sha256:2a4deccbc7b8c5bc53f2fde315ccd93e7f2c2022e9288f7a93ed642feb808dc1_amd64, devspaces/code-rhel8@sha256:2a4deccbc7b8c5bc53f2fde315ccd93e7f2c2022e9288f7a93ed642feb808dc1_amd64 |
| Red Hat | devspaces/imagepuller-rhel8@sha256:338d93fda80d0c86e58807f9f0909d8b1ddbc8693076619b3a32ea23c0142cff_ppc64le as a component of Red Hat OpenShift Dev Spaces 3 | devspaces/imagepuller-rhel8@sha256:338d93fda80d0c86e58807f9f0909d8b1ddbc8693076619b3a32ea23c0142cff_ppc64le |
| Red Hat | devspaces/traefik-rhel8@sha256:00da91880194659c5b62835590cd31d7c80b8a9e5ce7575a7dc4e3f6741b8a81_amd64 as a component of Red Hat OpenShift Dev Spaces 3 | *, devspaces/traefik-rhel8@sha256:00da91880194659c5b62835590cd31d7c80b8a9e5ce7575a7dc4e3f6741b8a81_amd64 |
| Red Hat | devspaces/devspaces-operator-bundle@sha256:c667834c64b1b67d41637f7fa854c1eb105cef5276113e4b848f1f4c206d20e8_s390x as a component of Red Hat OpenShift Dev Spaces 3 | * |
…and 48 more
Timeline
- Nov 25, 2024 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 30, 2026 Security Advisory
- Apr 30, 2026 Security Advisory
- Apr 30, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2310528 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2317724 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2318052 issue
- https://www.cve.org/CVERecord?id=CVE-2023-42282 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-21534 advisory
- https://github.com/JSONPath-Plus/JSONPath/issues/226 advisory
- https://access.redhat.com/security/cve/CVE-2024-29415 advisory
- https://go.dev/cl/611238 advisory
- https://groups.google.com/g/golang-dev/c/S9POB9NCTdk advisory
- https://pkg.go.dev/vuln/GO-2024-3105 advisory
- https://access.redhat.com/security/cve/CVE-2024-45296 advisory
- https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45813 advisory
- https://github.com/delvedor/find-my-way/security/advisories/GHSA-rrr8-f88r-h8q6 advisory
- https://github.com/cure53/DOMPurify/commit/0ef5e537a514f904b6aa1d7ad9e749e365d7185f advisory
- https://www.cve.org/CVERecord?id=CVE-2024-48949 advisory
- https://github.com/indutny/elliptic/compare/v6.5.5...v6.5.6 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2265161 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2284554 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2317968 issue
…and 43 more