VDB
RHSA-2025%3A1448
RHSA-2025%3A1448
PUBLISHED
CVSS 4.400000095367432 MEDIUM
A Regular Expression Denial of Service (ReDoS) vulnerability was found in the cross-spawn package for Node.js. Due to improper input sanitization, an attacker can increase CPU usage and crash the program with a large, specially crafted string.
Risk Scores
CVSS 3.1
4.400000095367432
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhoai/odh-mm-rest-proxy-rhel8@sha256:c2995df85c0023ebc43e9dc30a258323353387450af99295fd67b57fb8afc36b_amd64 as a component of Red Hat OpenShift AI 2.17 | * |
| Red Hat | registry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:e19276083d932dad46be57674cadf2757a4eeb5d1e2cc2b4ae650e0c8d2c1b02_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-dashboard-rhel8@sha256:e19276083d932dad46be57674cadf2757a4eeb5d1e2cc2b4ae650e0c8d2c1b02_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel8@sha256:5979ff12a1b4b96b307ffc601388c195a5ce49bf53c85b7a9e7da20f6266ff8d_amd64 as a component of Red Hat OpenShift AI 2.17 | * |
| Red Hat | registry.redhat.io/rhoai/odh-kueue-controller-rhel8@sha256:849977d802846fceb0b642c28db3611a88163b6025de36695205d81162935497_amd64 as a component of Red Hat OpenShift AI 2.17 | * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel8@sha256:83c2d8f4f66835bd22cfd29f4ae9b57bfacf16393b5080fbbe3057cab90dfdda_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-persistenceagent-v2-rhel8@sha256:b94552aa082251c6c7b85d49cd3444a12149b8825473619517fa3edbd1748195_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:f9a98109664adec37649f616f63e86605df2feb6fb9178b37ddeba59f6460930_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:f9a98109664adec37649f616f63e86605df2feb6fb9178b37ddeba59f6460930_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-model-registry-rhel8@sha256:713025cc0357b2052bec976eb74f2e0ec14c1ea4426c1f1eb78a6331973db7a7_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-model-registry-rhel8@sha256:713025cc0357b2052bec976eb74f2e0ec14c1ea4426c1f1eb78a6331973db7a7_amd64, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-model-registry-operator-rhel8@sha256:47653dc36a82d1b00f10d03df92aa836be8111c381cdb9caabd3a68829f6d683_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-model-registry-operator-rhel8@sha256:47653dc36a82d1b00f10d03df92aa836be8111c381cdb9caabd3a68829f6d683_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-mm-rest-proxy-rhel8@sha256:c2995df85c0023ebc43e9dc30a258323353387450af99295fd67b57fb8afc36b_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:fc6d4c739d6e71fd613aa5ba0821035f0a8e783ea94a411abb82b26a5d79406d_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-codeflare-operator-rhel8@sha256:fc6d4c739d6e71fd613aa5ba0821035f0a8e783ea94a411abb82b26a5d79406d_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-operator-bundle@sha256:8894db3352d2c8e666bbd0b93ae36474f6d2dcf1e59c24328de8a95667a45bb0_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-operator-bundle@sha256:8894db3352d2c8e666bbd0b93ae36474f6d2dcf1e59c24328de8a95667a45bb0_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8@sha256:d78353c90bfbdf943547d5f6e3f547ab02f47836ca2cbf3f101977685bf3e34c_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8@sha256:d78353c90bfbdf943547d5f6e3f547ab02f47836ca2cbf3f101977685bf3e34c_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-api-server-v2-rhel8@sha256:85b991f09d439ca1e1df6b490097f587a76a2aaf94cb98f360e513f0d153483a_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:f9a98109664adec37649f616f63e86605df2feb6fb9178b37ddeba59f6460930_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-mlmd-grpc-server-rhel8@sha256:f9a98109664adec37649f616f63e86605df2feb6fb9178b37ddeba59f6460930_amd64, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:58fc4ea5fcabd64c061a4f30259b354ffbcbb8c16ffc442f47404ddd49ffd3c9_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:58fc4ea5fcabd64c061a4f30259b354ffbcbb8c16ffc442f47404ddd49ffd3c9_amd64, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-kueue-controller-rhel8@sha256:849977d802846fceb0b642c28db3611a88163b6025de36695205d81162935497_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, registry.redhat.io/rhoai/odh-kueue-controller-rhel8@sha256:849977d802846fceb0b642c28db3611a88163b6025de36695205d81162935497_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:58fc4ea5fcabd64c061a4f30259b354ffbcbb8c16ffc442f47404ddd49ffd3c9_amd64 as a component of Red Hat OpenShift AI 2.17 | registry.redhat.io/rhoai/odh-modelmesh-rhel8@sha256:58fc4ea5fcabd64c061a4f30259b354ffbcbb8c16ffc442f47404ddd49ffd3c9_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel8@sha256:913162d37998b5f5503ea9a6acdd32a03fe1588658ed481027c381feaa298542_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-service-rhel8@sha256:9f5c7f682c534d3d07daceaef8c49c7d03d489f160b0adccdb296c5b9f67b748_amd64 as a component of Red Hat OpenShift AI 2.17 | *, *, * |
…and 37 more
Timeline
- Feb 13, 2025 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Jul 13, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2025:1448 advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ advisory
- https://access.redhat.com/security/cve/CVE-2024-45338 advisory
- https://access.redhat.com/security/cve/CVE-2024-45337 advisory
- https://access.redhat.com/security/cve/CVE-2024-49767 advisory
- https://access.redhat.com/security/cve/CVE-2024-21538 advisory
- https://access.redhat.com/security/cve/CVE-2024-52798 advisory
- https://access.redhat.com/security/cve/CVE-2024-55565 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_1448.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2324550 issue
- https://www.cve.org/CVERecord?id=CVE-2024-21538 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-21538 advisory
- https://github.com/moxystudio/node-cross-spawn/commit/5ff3a07d9add449021d806e45c4168203aa833ff advisory
- https://github.com/moxystudio/node-cross-spawn/commit/640d391fde65388548601d95abedccc12943374f advisory
- https://github.com/moxystudio/node-cross-spawn/pull/160 advisory
- https://security.snyk.io/vuln/SNYK-JS-CROSSSPAWN-8303230 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2331720 issue
- https://www.cve.org/CVERecord?id=CVE-2024-45337 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45337 advisory
…and 39 more