VDB
RHSA-2026%3A3870
RHSA-2026%3A3870
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in Lodash. A prototype pollution vulnerability in the _.unset and _.omit functions allows an attacker able to control property paths to delete methods from global prototypes. By removing essential functionalities, this can result in a denial of service.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:103394f2799040d165d26e83a4d011940a27a311221cf53388025da8cfe2bb3b_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-alibaba-cloud-controller-manager-rhel8@sha256:103394f2799040d165d26e83a4d011940a27a311221cf53388025da8cfe2bb3b_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:b5967b8947d53c71c2d6d86a31c1d2b192688504c090b27cf92c330affdbb9b5_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-aws-cluster-api-controllers-rhel8@sha256:b5967b8947d53c71c2d6d86a31c1d2b192688504c090b27cf92c330affdbb9b5_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:8b973769b317e1ca3ec4df7ac8bde2fd3898649a73bf16c6d436d5dbbcf7d1b5_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:8b973769b317e1ca3ec4df7ac8bde2fd3898649a73bf16c6d436d5dbbcf7d1b5_amd64, *, registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:8b973769b317e1ca3ec4df7ac8bde2fd3898649a73bf16c6d436d5dbbcf7d1b5_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-agent-installer-api-server-rhel8@sha256:8b973769b317e1ca3ec4df7ac8bde2fd3898649a73bf16c6d436d5dbbcf7d1b5_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | registry.redhat.io/openshift4/ose-multus-admission-controller@sha256:a46233e5b1fa0a5a1a764a46c49a11269fadd87de378e28cb5fef0180ff7bf4f_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-multus-admission-controller@sha256:a46233e5b1fa0a5a1a764a46c49a11269fadd87de378e28cb5fef0180ff7bf4f_amd64, registry.redhat.io/openshift4/ose-multus-admission-controller@sha256:a46233e5b1fa0a5a1a764a46c49a11269fadd87de378e28cb5fef0180ff7bf4f_amd64, * |
| Red Hat | registry.redhat.io/openshift4/ose-prom-label-proxy@sha256:220a41bce9e80c6277055d596c02b3d62cf5905cfda772eb705c8ed4dd51feef_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-prom-label-proxy@sha256:220a41bce9e80c6277055d596c02b3d62cf5905cfda772eb705c8ed4dd51feef_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-prometheus-operator-admission-webhook-rhel8@sha256:1d1c4e5f78487db89666bd2fbee88fcc4fac0b1e62611a823a4971d088446369_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-external-snapshotter@sha256:3eb660f6971e2d8237b7b9ddb60e55e3bcccbd9f34b0cf3870bf1c18e07d25e0_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-image-registry-operator@sha256:9110db70398296e720496b0c7d0e02c5c0857248ce4d9625e80158de115cdb6f_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-cluster-image-registry-operator@sha256:9110db70398296e720496b0c7d0e02c5c0857248ce4d9625e80158de115cdb6f_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel8@sha256:1c61bea46954facb357a90cf7e8dcabb4073a45cee9e8928c3faf307f9d194a7_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel8@sha256:1c61bea46954facb357a90cf7e8dcabb4073a45cee9e8928c3faf307f9d194a7_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-operator@sha256:4ce64fc5f1b82f8eaca2aff35f5a4035ebe16dd67412aa73c783c7f2264d0078_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-cluster-kube-controller-manager-operator@sha256:4ce64fc5f1b82f8eaca2aff35f5a4035ebe16dd67412aa73c783c7f2264d0078_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-tools-rhel8@sha256:4343e0a0d02722a0019942174c7d1587d8e8abefbde48b7b6f374a76a125b875_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, registry.redhat.io/openshift4/ose-tools-rhel8@sha256:4343e0a0d02722a0019942174c7d1587d8e8abefbde48b7b6f374a76a125b875_amd64, registry.redhat.io/openshift4/ose-tools-rhel8@sha256:4343e0a0d02722a0019942174c7d1587d8e8abefbde48b7b6f374a76a125b875_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-kuryr-cni-rhel8@sha256:7bb99f7ef4a98fda5c3d6f972f243cfa8372294b28b9976b97ba96b776cfd81f_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-kuryr-cni-rhel8@sha256:7bb99f7ef4a98fda5c3d6f972f243cfa8372294b28b9976b97ba96b776cfd81f_amd64, registry.redhat.io/openshift4/ose-kuryr-cni-rhel8@sha256:7bb99f7ef4a98fda5c3d6f972f243cfa8372294b28b9976b97ba96b776cfd81f_amd64, registry.redhat.io/openshift4/ose-kuryr-cni-rhel8@sha256:7bb99f7ef4a98fda5c3d6f972f243cfa8372294b28b9976b97ba96b776cfd81f_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-keepalived-ipfailover@sha256:6eb5e9896c82bfcd569b9c002475c0a87054cc92b85792e66453044e4f27726c_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-keepalived-ipfailover@sha256:6eb5e9896c82bfcd569b9c002475c0a87054cc92b85792e66453044e4f27726c_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-ibm-vpc-block-csi-driver-operator-rhel8@sha256:6618f9828840cf41fffc19e89f5ae2077ac1aadaece6aa33fde8497b4fbf06e1_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-ibm-vpc-block-csi-driver-operator-rhel8@sha256:6618f9828840cf41fffc19e89f5ae2077ac1aadaece6aa33fde8497b4fbf06e1_amd64, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-gcp-cluster-api-controllers-rhel8@sha256:b2e49e53dc87c605e8ed9a412e6001f9e8bbfa15121a7bdaf42ec7cf5c5e5a4e_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-gcp-cluster-api-controllers-rhel8@sha256:b2e49e53dc87c605e8ed9a412e6001f9e8bbfa15121a7bdaf42ec7cf5c5e5a4e_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel8@sha256:1c61bea46954facb357a90cf7e8dcabb4073a45cee9e8928c3faf307f9d194a7_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel8@sha256:1c61bea46954facb357a90cf7e8dcabb4073a45cee9e8928c3faf307f9d194a7_amd64, registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel8@sha256:1c61bea46954facb357a90cf7e8dcabb4073a45cee9e8928c3faf307f9d194a7_amd64, registry.redhat.io/openshift4/ose-csi-livenessprobe-rhel8@sha256:1c61bea46954facb357a90cf7e8dcabb4073a45cee9e8928c3faf307f9d194a7_amd64 |
| Red Hat | registry.redhat.io/openshift4/ose-machine-api-provider-gcp-rhel8@sha256:fceb4dd066f16f2f26d706ad34e8bffbba4c9fb1f4598c3abf25e90fd65c25d5_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-cluster-openshift-apiserver-operator@sha256:72b65af0f9da924e1f96b490761c5e866a1e6d48d1d17a8e18e34722c7cf3858_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, *, * |
| Red Hat | registry.redhat.io/openshift4/ose-csi-driver-manila-rhel8@sha256:3ccf92e1ceed3bb4d7e92083204c4e818f59bc2be5d4b494e5c6e36afe49898c_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | *, *, * |
…and 365 more
Timeline
- Mar 12, 2026 CVE Published
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Distribution Patch
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Apr 29, 2026 Security Advisory
- Jul 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:3870 advisory
- https://access.redhat.com/security/cve/CVE-2025-13465 advisory
- https://access.redhat.com/security/cve/CVE-2025-58068 advisory
- https://access.redhat.com/security/cve/CVE-2025-65637 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3870.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2431740 issue
- https://www.cve.org/CVERecord?id=CVE-2025-13465 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13465 advisory
- https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2391958 issue
- https://www.cve.org/CVERecord?id=CVE-2025-58068 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-58068 advisory
- https://github.com/eventlet/eventlet/commit/0bfebd1117d392559e25b4bfbfcc941754de88fb advisory
- https://github.com/eventlet/eventlet/pull/1062 advisory
- https://github.com/eventlet/eventlet/security/advisories/GHSA-hw6f-rjfj-j7j7 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2418900 issue
- https://www.cve.org/CVERecord?id=CVE-2025-65637 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-65637 advisory
- https://github.com/mjuanxd/logrus-dos-poc exploit
…and 7 more