Update registry.redhat.io/openshift4/ose-cli-rhel9 Docker digest to cc66271 [SECURITY] - #111
Open
red-hat-konflux[bot] wants to merge 1 commit into
Conversation
…c66271 [SECURITY] Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #111 +/- ##
=======================================
Coverage 33.68% 33.68%
=======================================
Files 19 19
Lines 1879 1879
=======================================
Hits 633 633
Misses 1202 1202
Partials 44 44
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
84bb323→cc66271brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function
CVE-2026-14257
More information
Details
A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand() function, which can lead to excessive memory consumption. This can cause a denial of service (DoS) by crashing the application due to an out-of-memory error.
Severity
Important
References
ironic-python-agent: OpenStack Ironic Python Agent: Arbitrary code execution via malicious configuration
CVE-2026-66138
More information
Details
A vulnerability was found in Ironic-Python-Agent's (IPA) time syncing code. The value of the ntp_server configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root. This value can be set in three ways; directly in an operator-created ramdisk, set via kernel command line using Ironic, or passing the parameters via mDNS responder for mDNS enabled installation. For the most common, and highest security risk case, this means a Manager role associated with the project set as node.owner may be able to trigger this vulnerability.
Severity
Important
References
brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation
CVE-2026-69152
More information
Details
A flaw was found in the brace-expansion library. The
expand()function does not applymaxLengthwhen constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop, resulting in a denial of service. This issue is due to an incomplete mitigation of CVE-2026-14257.Severity
Important
References
nanoid: nanoid: Predictable ID generation due to integer overflow
CVE-2026-73086
More information
Details
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the
nanoid(size)function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.Severity
Important
References
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.