A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

github.com/hashicorp/memberlist: HashiCorp memberlist: Denial of Service via push/pull state handling net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header openshift/router: openshift/router: cloud metadata SSRF via FQDN-typed EndpointSlice bypasses destination validation ironic-python-agent: OpenStack ironic-python-agent: Arbitrary code execution via malicious image openstack-ironic: Prevent rehoming resources to nodes with different owner sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass postcss: PostCSS: Information disclosure and denial of service via crafted CSS input golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability sqlparse: sqlparse: Denial of Service via quadratic CPU consumption in SQL parsing openstack-ironic: openstack-ironic: Arbitrary IPMI command execution via send_raw deployment step golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input html/template: golang: Go html/template: Cross-Site Scripting via pathological input encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue net/url: golan…