RHSA-2025:0082: Important: Red Hat OpenShift Data Foundation 4.16.5 Bug Fix Update

Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multi-cloud data management service with an S3 compatible API.<br>Security Fix(es) from Bugzilla:<br><li> dompurify: DOMPurify vulnerable to tampering by prototype pollution (CVE-2024-48910)</li> <li> tough-cookie: prototype pollution in cookie memstore (CVE-2023-26136)</li> <li> css-tools: Improper Input Validation causes Denial of Service via Regular Expression (CVE-2023-26364)</li> <li> net/<a href="http:" target="blank">http:</a> Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)</li> <li> path-to-regexp: Backtracking regular expressions cause ReDoS (CVE-2024-45296)</li> <li> express: Improper Input Handling in Express Redirects (CVE-2024-43796)</li> <li> send: Code Execution Vulnerability in Send Library (CVE-2024-43799)</li> <li> serve-static: Improper Sanitization in serve-static (CVE-2024-43800)</li> <li> nanoid: nanoid mishandles non-integer values (CVE-2024-55565)</li> <li> cross-spawn: regular expression denial of service (CVE-2024-21538)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

— Red Hat