VDB
RHSA-2025%3A1448
RHSA-2025%3A1448
PUBLISHED
CVSS 4.400000095367432 MEDIUM
A Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package for Node.js. Due to improper input sanitization, an attacker can increase CPU usage and crash the program with a large, specially crafted string.
Risk Scores
CVSS 3.1
4.400000095367432
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhoai/odh-mm-rest-proxy-rhel8@sha256:c2995df85c0023ebc43e9dc30a258323353387450af99295fd67b57fb8afc36b_amd64 as a component of Red Hat OpenShift AI 2.17 | * |
| Red Hat | registry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:e19276083d932dad46be57674cadf2757a4eeb5d1e2cc2b4ae650e0c8d2c1b02_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:e19276083d932dad46be57674cadf2757a4eeb5d1e2cc2b4ae650e0c8d2c1b02_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8@sha256:5979ff12a1b4b96b307ffc601388c195a5ce49bf53c85b7a9e7da20f6266ff8d_amd64 as a component of Red Hat OpenShift AI 2.17 | * |
| Red Hat | registry.redhat.io/rhoai/odh-kueue-controller-rhel8@sha256:849977d802846fceb0b642c28db3611a88163b6025de36695205d81162935497_amd64 as a component of Red Hat OpenShift AI 2.17 | * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel8@sha256:83c2d8f4f66835bd22cfd29f4ae9b57bfacf16393b5080fbbe3057cab90dfdda_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8@sha256:b94552aa082251c6c7b85d49cd3444a12149b8825473619517fa3edbd1748195_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:f9a98109664adec37649f616f63e86605df2feb6fb9178b37ddeba59f6460930_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:f9a98109664adec37649f616f63e86605df2feb6fb9178b37ddeba59f6460930_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-model-registry-rhel8@sha256:713025cc0357b2052bec976eb74f2e0ec14c1ea4426c1f1eb78a6331973db7a7_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-model-registry-rhel8@sha256:713025cc0357b2052bec976eb74f2e0ec14c1ea4426c1f1eb78a6331973db7a7_amd64, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-model-registry-operator-rhel8@sha256:47653dc36a82d1b00f10d03df92aa836be8111c381cdb9caabd3a68829f6d683_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-model-registry-operator-rhel8@sha256:47653dc36a82d1b00f10d03df92aa836be8111c381cdb9caabd3a68829f6d683_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-mm-rest-proxy-rhel8@sha256:c2995df85c0023ebc43e9dc30a258323353387450af99295fd67b57fb8afc36b_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:fc6d4c739d6e71fd613aa5ba0821035f0a8e783ea94a411abb82b26a5d79406d_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:fc6d4c739d6e71fd613aa5ba0821035f0a8e783ea94a411abb82b26a5d79406d_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-operator-bundle@sha256:8894db3352d2c8e666bbd0b93ae36474f6d2dcf1e59c24328de8a95667a45bb0_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-operator-bundle@sha256:8894db3352d2c8e666bbd0b93ae36474f6d2dcf1e59c24328de8a95667a45bb0_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8@sha256:d78353c90bfbdf943547d5f6e3f547ab02f47836ca2cbf3f101977685bf3e34c_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8@sha256:d78353c90bfbdf943547d5f6e3f547ab02f47836ca2cbf3f101977685bf3e34c_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel8@sha256:85b991f09d439ca1e1df6b490097f587a76a2aaf94cb98f360e513f0d153483a_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:f9a98109664adec37649f616f63e86605df2feb6fb9178b37ddeba59f6460930_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:f9a98109664adec37649f616f63e86605df2feb6fb9178b37ddeba59f6460930_amd64, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:58fc4ea5fcabd64c061a4f30259b354ffbcbb8c16ffc442f47404ddd49ffd3c9_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:58fc4ea5fcabd64c061a4f30259b354ffbcbb8c16ffc442f47404ddd49ffd3c9_amd64, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-kueue-controller-rhel8@sha256:849977d802846fceb0b642c28db3611a88163b6025de36695205d81162935497_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, registry.redhat.io/rhoai/odh-kueue-controller-rhel8@sha256:849977d802846fceb0b642c28db3611a88163b6025de36695205d81162935497_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:58fc4ea5fcabd64c061a4f30259b354ffbcbb8c16ffc442f47404ddd49ffd3c9_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:58fc4ea5fcabd64c061a4f30259b354ffbcbb8c16ffc442f47404ddd49ffd3c9_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel8@sha256:913162d37998b5f5503ea9a6acdd32a03fe1588658ed481027c381feaa298542_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-service-rhel8@sha256:9f5c7f682c534d3d07daceaef8c49c7d03d489f160b0adccdb296c5b9f67b748_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
…and 37 more
Timeline
- Feb 13, 2025 CVE Published
- Apr 25, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- Jul 5, 2026 Distribution Patch
- Jul 5, 2026 Security Advisory
- Jul 5, 2026 Security Advisory
- Jul 13, 2026 CVE Updated
- Jul 13, 2026 Security Advisory
- Jul 13, 2026 Security Advisory
References
- https://access.redhat.com/security/cve/CVE-2024-52798 advisory
- https://access.redhat.com/security/cve/CVE-2024-55565 advisory
- https://github.com/golang/crypto/commit/b4f1988a35dee11ec3e05d6bf3e90b695fbd8909 advisory
- https://go.dev/cl/635315 advisory
- https://access.redhat.com/security/cve/CVE-2024-45339 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2342463 issue
- https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2 advisory
- https://github.com/pallets/quart/commit/5e78c4169b8eb66b91ead3e62d44721b9e1644ee advisory
- https://github.com/pillarjs/path-to-regexp/commit/f01c26a013b1889f0c217c643964513acf17f6a4 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-55565 advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://access.redhat.com/security/cve/CVE-2024-49767 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://pkg.go.dev/vuln/GO-2024-3321 advisory
- https://pkg.go.dev/vuln/GO-2024-3333 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45339 advisory
- https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File advisory
- https://pkg.go.dev/vuln/GO-2025-3372 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2321829 issue
…and 39 more