VDB
RHSA-2024%3A2815
RHSA-2024%3A2815
PUBLISHED
CVSS 7.400000095367432 HIGH
A flaw was found in the webpack-dev-middleware package, where it failed to validate the supplied URL address sufficiently before returning local files. This flaw allows an attacker to craft URLs to return arbitrary local files from the developer's machine. The lack of normalization before calling the middleware also allows the attacker to perform path traversal attacks on the target environment.
Risk Scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:21afa76182bb4d58037b1709f46fa0600bcaaa14f1a98635fc0f41b06912925c_ppc64le as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/argocd-rhel8@sha256:21afa76182bb4d58037b1709f46fa0600bcaaa14f1a98635fc0f41b06912925c_ppc64le |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:413df9e2d589a8d58ad8ad3ffeec6ad1e1adbc75f9ae9f2954d909e49d867c34_s390x as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/kam-delivery-rhel8@sha256:413df9e2d589a8d58ad8ad3ffeec6ad1e1adbc75f9ae9f2954d909e49d867c34_s390x |
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:4f6122194bee9ef5f62c1c19784dbef2acc13ad598a68c6049dfd3ce2a830089_amd64 as a component of Red Hat OpenShift GitOps 1.11 | * |
| Red Hat | openshift-gitops-1/gitops-operator-bundle@sha256:d8d9a224745f1952819cf831620d5b4ef08f905d80b33d66e4043e5b0163b06a_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/gitops-operator-bundle@sha256:d8d9a224745f1952819cf831620d5b4ef08f905d80b33d66e4043e5b0163b06a_amd64 |
| Red Hat | openshift-gitops-1/gitops-rhel8@sha256:6ed362945bd2aba3651d4bf65e859abe5a02e22fa536820f52e5e4ce7fd344ed_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/gitops-rhel8@sha256:6ed362945bd2aba3651d4bf65e859abe5a02e22fa536820f52e5e4ce7fd344ed_amd64 |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:278bf0667cf12db22c857b8c7a843c5611269e18c7e98f2dacb6b98f51c9453c_s390x as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/console-plugin-rhel8@sha256:278bf0667cf12db22c857b8c7a843c5611269e18c7e98f2dacb6b98f51c9453c_s390x |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:e2a5884b0cdd1e9d1204e1731bf42eba7f270eebb62c5e3a18eafa7fc422a3ed_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/kam-delivery-rhel8@sha256:e2a5884b0cdd1e9d1204e1731bf42eba7f270eebb62c5e3a18eafa7fc422a3ed_amd64 |
| Red Hat | openshift-gitops-1/argo-rollouts-rhel8@sha256:930382e80334938d8c77c535e5902a21e739b4c85b6ec3e7594d1f974d215d68_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/argo-rollouts-rhel8@sha256:930382e80334938d8c77c535e5902a21e739b4c85b6ec3e7594d1f974d215d68_amd64 |
| Red Hat | openshift-gitops-1/argo-rollouts-rhel8@sha256:bdd0bb4fb7deefedde48b96c1bf400c0159869ae0a18658aaf93c5bd34bcfe8b_ppc64le as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/argo-rollouts-rhel8@sha256:bdd0bb4fb7deefedde48b96c1bf400c0159869ae0a18658aaf93c5bd34bcfe8b_ppc64le |
| Red Hat | openshift-gitops-1/gitops-rhel8@sha256:388f2d08833e70aefd6e840582f7483ac0ce2eb271bc490d1a2c73f5dd5f5576_ppc64le as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/gitops-rhel8@sha256:388f2d08833e70aefd6e840582f7483ac0ce2eb271bc490d1a2c73f5dd5f5576_ppc64le |
| Red Hat | openshift-gitops-1/must-gather-rhel8@sha256:4edbd07b7512d83767a78841c04a498dc76b58db286a349ddcb900c7232031a2_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/must-gather-rhel8@sha256:4edbd07b7512d83767a78841c04a498dc76b58db286a349ddcb900c7232031a2_amd64 |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:36e65a2fdb47fa6e6352d2c4ba97d739390804acf45846d7d46e1ed39b58f9ce_arm64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/gitops-rhel8-operator@sha256:36e65a2fdb47fa6e6352d2c4ba97d739390804acf45846d7d46e1ed39b58f9ce_arm64 |
| Red Hat | openshift-gitops-1/argo-rollouts-rhel8@sha256:685983400e1ada4332a0416ffe47f593fab34da51dfbd1aac7f07e84524fe22b_s390x as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/argo-rollouts-rhel8@sha256:685983400e1ada4332a0416ffe47f593fab34da51dfbd1aac7f07e84524fe22b_s390x |
| Red Hat | openshift-gitops-1/argocd-rhel8@sha256:1ea709aea08afab4d98092f33b935600de1c1b175f03e399700fd5dd155494ec_s390x as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/argocd-rhel8@sha256:1ea709aea08afab4d98092f33b935600de1c1b175f03e399700fd5dd155494ec_s390x |
| Red Hat | openshift-gitops-1/kam-delivery-rhel8@sha256:fdad9093445ce4b8122dc804ff7ae9b6195cd7c5beac953e8fc4038a344ed533_ppc64le as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/kam-delivery-rhel8@sha256:fdad9093445ce4b8122dc804ff7ae9b6195cd7c5beac953e8fc4038a344ed533_ppc64le |
| Red Hat | openshift-gitops-1/must-gather-rhel8@sha256:be52dd86d5d4203faba9568d59c84531ebc97d07d54649422c1bdf61173227fe_s390x as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/must-gather-rhel8@sha256:be52dd86d5d4203faba9568d59c84531ebc97d07d54649422c1bdf61173227fe_s390x |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:7d673f63ef8945f66a751b901fa1cc60d12e56961ab8c004a5fd396d7d282bf0_arm64 as a component of Red Hat OpenShift GitOps 1.11 | * |
| Red Hat | openshift-gitops-1/gitops-rhel8-operator@sha256:0f1b867fc8c6194ec054ec8207222e13812d407a7fb1653090b7a27a06f6f831_s390x as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/gitops-rhel8-operator@sha256:0f1b867fc8c6194ec054ec8207222e13812d407a7fb1653090b7a27a06f6f831_s390x |
| Red Hat | openshift-gitops-1/console-plugin-rhel8@sha256:638def92b1eb97ab9ec59b0c535a651f5cb42992fca30a51d347684831ccff48_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/console-plugin-rhel8@sha256:638def92b1eb97ab9ec59b0c535a651f5cb42992fca30a51d347684831ccff48_amd64 |
| Red Hat | openshift-gitops-1/dex-rhel8@sha256:de2e79f849a8bba66dbf66b72b5eceb8c8b92f15d511c049aec251fa6a4d222d_amd64 as a component of Red Hat OpenShift GitOps 1.11 | openshift-gitops-1/dex-rhel8@sha256:de2e79f849a8bba66dbf66b72b5eceb8c8b92f15d511c049aec251fa6a4d222d_amd64 |
…and 13 more
Timeline
- May 10, 2024 CVE Published
- Apr 24, 2026 CVE Updated
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2024:2815 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.openshift.com/gitops/1.11/release_notes/gitops-release-notes.html advisory
- https://docs.openshift.com/gitops/1.11/understanding_openshift_gitops/about-redhat-openshift-gitops.html advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2270863 issue
- https://issues.redhat.com/browse/GITOPS-3736 advisory
- https://issues.redhat.com/browse/GITOPS-4226 advisory
- https://issues.redhat.com/browse/GITOPS-4358 advisory
- https://issues.redhat.com/browse/GITOPS-4513 advisory
- https://issues.redhat.com/browse/GITOPS-4543 advisory
- https://issues.redhat.com/browse/GITOPS-4645 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2815.json advisory
- https://access.redhat.com/security/cve/CVE-2024-29180 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-29180 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-29180 advisory
- https://github.com/webpack/webpack-dev-middleware/security/advisories/GHSA-wr3j-pwj9-hqq6 advisory