VDB
RHSA-2025:0654
RHSA-2025:0654
PUBLISHED
CVSS 5.300000190734863 MEDIUM
There's a flaw in the PostCSS package where it fails to properly validate the input CSS, causing commented lines to be interpreted as code. An attacker may leverage that by crafting a CSS file with comments containing CSS code in order to force PostCSS to include the malicious CSS elements in its output. An successful attack may lead to integrity impact as it may inject elements in a web page when parsing untrusted CSS input.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-deployer-rhel9@sha256:e474c09f4fea1e90a047ae158dde7287980943c75f24fc0920bf3cc4b74675a4_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-deployer-rhel9@sha256:e474c09f4fea1e90a047ae158dde7287980943c75f24fc0920bf3cc4b74675a4_arm64, openshift4/ose-deployer-rhel9@sha256:e474c09f4fea1e90a047ae158dde7287980943c75f24fc0920bf3cc4b74675a4_arm64, openshift4/ose-deployer-rhel9@sha256:e474c09f4fea1e90a047ae158dde7287980943c75f24fc0920bf3cc4b74675a4_arm64 |
| Red Hat | openshift4/ose-agent-installer-csr-approver-rhel9@sha256:9a7aeb0a168d27553f8b348caee99116fb4f3832d841d8e6f2a85609cf1ac267_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-agent-installer-csr-approver-rhel9@sha256:9a7aeb0a168d27553f8b348caee99116fb4f3832d841d8e6f2a85609cf1ac267_amd64, openshift4/ose-agent-installer-csr-approver-rhel9@sha256:9a7aeb0a168d27553f8b348caee99116fb4f3832d841d8e6f2a85609cf1ac267_amd64, openshift4/ose-agent-installer-csr-approver-rhel9@sha256:9a7aeb0a168d27553f8b348caee99116fb4f3832d841d8e6f2a85609cf1ac267_amd64 |
| Red Hat | openshift4/ose-cluster-node-tuning-rhel9-operator@sha256:51752c6357faf6cb2fb999982f846dce061ab1b8a0d53005408846643e731a7c_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | openshift4/ose-agent-installer-node-agent-rhel9@sha256:fe6922ec1c1eb497bf032639b2e627d66930eab5521b68a89f093e7c5d0da024_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, openshift4/ose-agent-installer-node-agent-rhel9@sha256:fe6922ec1c1eb497bf032639b2e627d66930eab5521b68a89f093e7c5d0da024_arm64, openshift4/ose-agent-installer-node-agent-rhel9@sha256:fe6922ec1c1eb497bf032639b2e627d66930eab5521b68a89f093e7c5d0da024_arm64 |
| Red Hat | openshift4/ose-agent-installer-csr-approver-rhel9@sha256:9a7aeb0a168d27553f8b348caee99116fb4f3832d841d8e6f2a85609cf1ac267_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | openshift4/ose-docker-builder-rhel9@sha256:2a7da4e4886a32a444acf61b4adb06a4a249bd79e30795edd2e82a1c3144233a_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-docker-builder-rhel9@sha256:2a7da4e4886a32a444acf61b4adb06a4a249bd79e30795edd2e82a1c3144233a_arm64, openshift4/ose-docker-builder-rhel9@sha256:2a7da4e4886a32a444acf61b4adb06a4a249bd79e30795edd2e82a1c3144233a_arm64, openshift4/ose-docker-builder-rhel9@sha256:2a7da4e4886a32a444acf61b4adb06a4a249bd79e30795edd2e82a1c3144233a_arm64 |
| Red Hat | openshift4/ose-installer-artifacts-rhel9@sha256:de89d8cf2e05fba5eb5c1f2231d280fc8df44b7044a8c375c360ced4901447f1_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, openshift4/ose-installer-artifacts-rhel9@sha256:de89d8cf2e05fba5eb5c1f2231d280fc8df44b7044a8c375c360ced4901447f1_s390x, * |
| Red Hat | openshift4/ose-installer-altinfra-rhel9@sha256:4d8e5200a8d49a6e99245ae731b99145af8b39f049f721e7ed56ed38d133047b_s390x as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-installer-altinfra-rhel9@sha256:4d8e5200a8d49a6e99245ae731b99145af8b39f049f721e7ed56ed38d133047b_s390x, openshift4/ose-installer-altinfra-rhel9@sha256:4d8e5200a8d49a6e99245ae731b99145af8b39f049f721e7ed56ed38d133047b_s390x, openshift4/ose-installer-altinfra-rhel9@sha256:4d8e5200a8d49a6e99245ae731b99145af8b39f049f721e7ed56ed38d133047b_s390x |
| Red Hat | openshift4/ose-cluster-autoscaler-rhel9@sha256:133d553c5e0d134198ed17309c389c105cdee482a50981b126b31e5c61dd6b8c_s390x as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-cluster-autoscaler-rhel9@sha256:133d553c5e0d134198ed17309c389c105cdee482a50981b126b31e5c61dd6b8c_s390x, openshift4/ose-cluster-autoscaler-rhel9@sha256:133d553c5e0d134198ed17309c389c105cdee482a50981b126b31e5c61dd6b8c_s390x, openshift4/ose-cluster-autoscaler-rhel9@sha256:133d553c5e0d134198ed17309c389c105cdee482a50981b126b31e5c61dd6b8c_s390x |
| Red Hat | openshift4/ose-oauth-apiserver-rhel9@sha256:80e8a2f68ed7f13ae80b32d5c1d14ba116917c24499e28f5b645f2f15223c245_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, openshift4/ose-oauth-apiserver-rhel9@sha256:80e8a2f68ed7f13ae80b32d5c1d14ba116917c24499e28f5b645f2f15223c245_amd64, * |
| Red Hat | openshift4/ose-agent-installer-orchestrator-rhel9@sha256:09510453464825905e0d17e3ba38d71cb5cd2c6613ee2e544288e6dfb0f05bab_arm64 as a component of Red Hat OpenShift Container Platform 4.17 | *, *, openshift4/ose-agent-installer-orchestrator-rhel9@sha256:09510453464825905e0d17e3ba38d71cb5cd2c6613ee2e544288e6dfb0f05bab_arm64 |
| Red Hat | openshift4/ose-cluster-capi-rhel9-operator@sha256:3608b2519b789a6c857ebe8d175caf561fa22a0bfa4b02bc1f75851464be7bba_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, openshift4/ose-cluster-capi-rhel9-operator@sha256:3608b2519b789a6c857ebe8d175caf561fa22a0bfa4b02bc1f75851464be7bba_s390x, openshift4/ose-cluster-capi-rhel9-operator@sha256:3608b2519b789a6c857ebe8d175caf561fa22a0bfa4b02bc1f75851464be7bba_s390x |
| Red Hat | openshift4/ose-deployer-rhel9@sha256:34f7223c62ed5ec030d6aa630c69bd711b1c8b3c9a5e1fed000c59516cef1062_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-deployer-rhel9@sha256:34f7223c62ed5ec030d6aa630c69bd711b1c8b3c9a5e1fed000c59516cef1062_ppc64le, *, openshift4/ose-deployer-rhel9@sha256:34f7223c62ed5ec030d6aa630c69bd711b1c8b3c9a5e1fed000c59516cef1062_ppc64le |
| Red Hat | openshift4/ose-azure-disk-csi-driver-rhel9-operator@sha256:20ed99c4d4dfada594c5cc034bab8d5fd31cab538cd7103ff9c53c17ffd1312f_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-azure-disk-csi-driver-rhel9-operator@sha256:20ed99c4d4dfada594c5cc034bab8d5fd31cab538cd7103ff9c53c17ffd1312f_amd64, openshift4/ose-azure-disk-csi-driver-rhel9-operator@sha256:20ed99c4d4dfada594c5cc034bab8d5fd31cab538cd7103ff9c53c17ffd1312f_amd64, * |
| Red Hat | openshift4/ose-console-rhel9@sha256:1756c3f84476b1753c8760772a370e39bb137fd521757a5a2ba4ec7078b4660d_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, *, * |
| Red Hat | openshift4/ose-hypershift-rhel9@sha256:dbbb0bd7bf838a3d5283b6a425c4f47749c95ad4e99935a93f480c633c2dfbba_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-hypershift-rhel9@sha256:dbbb0bd7bf838a3d5283b6a425c4f47749c95ad4e99935a93f480c633c2dfbba_ppc64le, openshift4/ose-hypershift-rhel9@sha256:dbbb0bd7bf838a3d5283b6a425c4f47749c95ad4e99935a93f480c633c2dfbba_ppc64le, openshift4/ose-hypershift-rhel9@sha256:dbbb0bd7bf838a3d5283b6a425c4f47749c95ad4e99935a93f480c633c2dfbba_ppc64le |
| Red Hat | openshift4/ose-tests-rhel9@sha256:f4f845838bf4a881260c956139208a464a61925fd1e4f8da7db3ad18c70d7eb2_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-tests-rhel9@sha256:f4f845838bf4a881260c956139208a464a61925fd1e4f8da7db3ad18c70d7eb2_ppc64le, openshift4/ose-tests-rhel9@sha256:f4f845838bf4a881260c956139208a464a61925fd1e4f8da7db3ad18c70d7eb2_ppc64le, openshift4/ose-tests-rhel9@sha256:f4f845838bf4a881260c956139208a464a61925fd1e4f8da7db3ad18c70d7eb2_ppc64le |
| Red Hat | openshift4/ose-tests-rhel9@sha256:4510761f2866981719885e1544c80b2d6658f18e05ac573dbcee194085f38486_s390x as a component of Red Hat OpenShift Container Platform 4.17 | *, openshift4/ose-tests-rhel9@sha256:4510761f2866981719885e1544c80b2d6658f18e05ac573dbcee194085f38486_s390x, openshift4/ose-tests-rhel9@sha256:4510761f2866981719885e1544c80b2d6658f18e05ac573dbcee194085f38486_s390x |
| Red Hat | openshift4/ose-machine-config-rhel9-operator@sha256:a600915e7014e76d633cd3f84e9f405c12799fe4f506795ff1c493000a1143d9_ppc64le as a component of Red Hat OpenShift Container Platform 4.17 | openshift4/ose-machine-config-rhel9-operator@sha256:a600915e7014e76d633cd3f84e9f405c12799fe4f506795ff1c493000a1143d9_ppc64le, openshift4/ose-machine-config-rhel9-operator@sha256:a600915e7014e76d633cd3f84e9f405c12799fe4f506795ff1c493000a1143d9_ppc64le, openshift4/ose-machine-config-rhel9-operator@sha256:a600915e7014e76d633cd3f84e9f405c12799fe4f506795ff1c493000a1143d9_ppc64le |
| Red Hat | openshift4/ose-openstack-cloud-controller-manager-rhel9@sha256:c0b27d4e9c1d50d321ba287c36c5c53651d9d055c13c35d1d88f4767f444cc05_amd64 as a component of Red Hat OpenShift Container Platform 4.17 | *, openshift4/ose-openstack-cloud-controller-manager-rhel9@sha256:c0b27d4e9c1d50d321ba287c36c5c53651d9d055c13c35d1d88f4767f444cc05_amd64, * |
…and 346 more
Timeline
- Jan 28, 2025 CVE Published
- Apr 29, 2026 Security Advisory
- May 3, 2026 Security Advisory
- May 7, 2026 Distribution Patch
- May 7, 2026 Security Advisory
- May 7, 2026 Security Advisory
- May 9, 2026 Security Advisory
- May 10, 2026 Security Advisory
- May 16, 2026 Distribution Patch
- Jul 25, 2026 CVE Updated
- Jul 25, 2026 Security Advisory
- Jul 25, 2026 Security Advisory
References
- https://issues.redhat.com/browse/OCPBUGS-48060 advisory
- https://issues.redhat.com/browse/OCPBUGS-48363 advisory
- https://access.redhat.com/security/cve/CVE-2023-44270 advisory
- https://github.com/postcss/postcss/blob/main/lib/tokenize.js#L25 advisory
- https://pkg.go.dev/vuln/GO-2025-3367 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2335888 issue
- https://issues.redhat.com/browse/OCPBUGS-46512 advisory
- https://issues.redhat.com/browse/OCPBUGS-48064 advisory
- https://issues.redhat.com/browse/OCPBUGS-48161 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-45338 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-21614 advisory
- https://issues.redhat.com/browse/OCPBUGS-47754 advisory
- https://issues.redhat.com/browse/OCPBUGS-48543 advisory
- https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/ advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2326998 issue
- https://www.cve.org/CVERecord?id=CVE-2024-24786 advisory
- https://www.cve.org/CVERecord?id=CVE-2024-55565 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-21613 advisory
- https://issues.redhat.com/browse/OCPBUGS-48155 advisory
…and 58 more