Update registry.redhat.io/openshift4/ose-cli-rhel9 Docker digest to cb5c5f7 [SECURITY] - #111
Open
red-hat-konflux[bot] wants to merge 1 commit into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #111 +/- ##
=======================================
Coverage 36.34% 36.34%
=======================================
Files 20 20
Lines 1992 1992
=======================================
Hits 724 724
Misses 1223 1223
Partials 45 45
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/docker-registry.redhat.io-openshift4-ose-cli-rhel9-vulnerability
branch
from
September 2, 2026 05:41
6f979c3 to
93fcf7d
Compare
red-hat-konflux
Bot
changed the title
…b5c5f7 [SECURITY] Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
red-hat-konflux
Bot
force-pushed
the
konflux/mintmaker/main/docker-registry.redhat.io-openshift4-ose-cli-rhel9-vulnerability
branch
from
September 9, 2026 04:26
93fcf7d to
62bfdd9
Compare
red-hat-konflux
Bot
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
84bb323→cb5c5f7Warning
Some dependencies could not be looked up. Check the warning logs for more information.
brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
CVE-2026-14257
More information
Details
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.
Severity
Important
References
ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration
CVE-2026-66138
More information
Details
A vulnerability was found in Ironic-Python-Agent's (IPA) time syncing code. The value of the ntp_server configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root. This value can be set in three ways; directly in an operator-created ramdisk, set via kernel command line using Ironic, or passing the parameters via mDNS responder for mDNS enabled installation. For the most common, and highest security risk case, this means a Manager role associated with the project set as node.owner may be able to trigger this vulnerability.
Severity
Important
References
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
CVE-2026-69152
More information
Details
A flaw was found in the brace-expansion library. The
expand()function does not applymaxLengthwhen constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.Severity
Important
References
nanoid: nanoid: Predictable ID generation due to integer overflow
CVE-2026-73086
More information
Details
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the
nanoid(size)function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.Severity
Important
References
postcss: PostCSS: Information disclosure and denial of service via crafted CSS input
CVE-2026-45623
More information
Details
A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifically the first few bytes of file content. Additionally, this vulnerability may be exploited to cause a Denial of Service (DoS) by targeting large files, making the system unavailable.
Severity
Important
References
ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification
CVE-2026-54272
More information
Details
A flaw was found in the
ip-addresslibrary. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery (SSRF) due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassification to bypass network restrictions and potentially access or manipulate internal resources. This vulnerability can be exploited on any dual-stack host for IPv4-mapped addresses, and for NAT64, it requires a NAT64/DNS64 gateway in the deployment network.Severity
Important
References
postcss: PostCSS: Information disclosure via crafted sourceMappingURL
CVE-2026-69153
More information
Details
A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration (the 'from' parameter) is not set. This can cause the application to read and expose unintended source-map files, potentially revealing sensitive information about the application's source code.
Severity
Important
References
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass
CVE-2026-69192
More information
Details
A flaw was found in the
ip-addresslibrary. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass security measures like Server-Side Request Forgery (SSRF) filters and potentially gain unauthorized access to internal systems.Severity
Important
References
tar: node-tar: Denial of Service via crafted long-path tar archive
CVE-2026-73566
More information
Details
A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the
filesFilterfunction can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives.Severity
Important
References
fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority
CVE-2026-18446
More information
Details
A flaw was found in fast-uri. This vulnerability arises because fast-uri incorrectly parses Uniform Resource Identifiers (URIs) when a backslash is used in place of a forward slash to introduce the authority component. This discrepancy with Node's native WHATWG URL parser can lead to host confusion. A remote attacker could exploit this to bypass security policies, such as allowlists or Server-Side Request Forgery (SSRF) filters, potentially redirecting applications to unintended hosts.
Severity
Important
References
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.