{ "threat_severity" : "Important", "public_date" : "2026-05-12T19:43:16Z", "bugzilla" : { "description" : "ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input", "id" : "2476810", "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2476810" }, "cvss3" : { "cvss3_base_score" : "8.1", "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "status" : "verified" }, "cwe" : "CWE-79", "details" : [ "ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage (emitted by the Address6 constructor for invalid input) can contain unescaped attacker-controlled content in one branch. An application that (1) passes untrusted input to Address6 and (2) renders the output of these methods, or the thrown error's parseMessage, as HTML (e.g. via innerHTML) is vulnerable to cross-site scripting. This vulnerability is fixed in 10.1.1.", "A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting (XSS) by providing untrusted input to the Address6 constructor. When an application renders the output of Address6.group(), Address6.link(), or the AddressError.parseMessage as HTML without proper escaping, the attacker-controlled content can be executed in the user's browser." ], "statement" : "This vulnerability in the `ip-address` JavaScript library is rated as Important. It allows for cross-site scripting (XSS) when an application processes untrusted input through the `Address6` constructor and subsequently renders the unescaped output of methods like `Address6.group()`, `Address6.link()`, or `AddressError.parseMessage` directly as HTML. While the library itself is affected, exploitation is contingent on specific application-level rendering practices that may not be common in Red Hat products.", "affected_release" : [ { "product_name" : "Red Hat Enterprise Linux 10", "release_date" : "2026-07-06T00:00:00Z", "advisory" : "RHSA-2026:35841", "cpe" : "cpe:/o:redhat:enterprise_linux:10.2", "package" : "nodejs24-1:24.18.0-1.el10_2" }, { "product_name" : "Red Hat Enterprise Linux 10", "release_date" : "2026-07-06T00:00:00Z", "advisory" : "RHSA-2026:35842", "cpe" : "cpe:/o:redhat:enterprise_linux:10.2", "package" : "nodejs22-1:22.23.1-2.el10_2" }, { "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support", "release_date" : "2026-07-14T00:00:00Z", "advisory" : "RHSA-2026:39246", "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0", "package" : "nodejs22-1:22.23.1-2.el10_0" }, { "product_name" : "Red Hat Enterprise Linux 8", "release_date" : "2026-07-15T00:00:00Z", "advisory" : "RHSA-2026:39868", "cpe" : "cpe:/a:redhat:enterprise_linux:8", "package" : "nodejs:24-8100020260630152626.6d880403" }, { "product_name" : "Red Hat Enterprise Linux 8", "release_date" : "2026-07-20T00:00:00Z", "advisory" : "RHSA-2026:41947", "cpe" : "cpe:/a:redhat:enterprise_linux:8", "package" : "nodejs:22-8100020260703140402.6d880403" }, { "product_name" : "Red Hat Enterprise Linux 9", "release_date" : "2026-07-06T00:00:00Z", "advisory" : "RHSA-2026:35891", "cpe" : "cpe:/a:redhat:enterprise_linux:9", "package" : "nodejs:24-9080020260626074955.rhel9" }, { "product_name" : "Red Hat Enterprise Linux 9", "release_date" : "2026-07-06T00:00:00Z", "advisory" : "RHSA-2026:35892", "cpe" : "cpe:/a:redhat:enterprise_linux:9", "package" : "nodejs:22-9080020260626075442.rhel9" }, { "product_name" : "Red Hat Ansible Automation Platform 2.6", "release_date" : "2026-07-01T00:00:00Z", "advisory" : "RHSA-2026:34374", "cpe" : "cpe:/a:redhat:ansible_automation_platform:2.6::el9", "package" : "ansible-automation-platform-tech-preview/mcp-server-rhel9:1782721130" }, { "product_name" : "Red Hat Developer Hub 1.10", "release_date" : "2026-07-08T00:00:00Z", "advisory" : "RHSA-2026:36754", "cpe" : "cpe:/a:redhat:rhdh:1.10::el9", "package" : "rhdh/rhdh-hub-rhel9:1783448184" }, { "product_name" : "Red Hat Developer Hub 1.9", "release_date" : "2026-06-30T00:00:00Z", "advisory" : "RHSA-2026:33574", "cpe" : "cpe:/a:redhat:rhdh:1.9::el9", "package" : "rhdh/rhdh-hub-rhel9:1782761244" }, { "product_name" : "Red Hat Migration Toolkit 1.8", "release_date" : "2026-07-20T00:00:00Z", "advisory" : "RHSA-2026:41928", "cpe" : "cpe:/a:redhat:rhmt:1.8::el8", "package" : "rhmtc/openshift-migration-ui-rhel8:1783690532" }, { "product_name" : "Red Hat OpenShift Dev Spaces 3.29", "release_date" : "2026-07-08T00:00:00Z", "advisory" : "RHSA-2026:36820", "cpe" : "cpe:/a:redhat:openshift_devspaces:3.29::el9", "package" : "devspaces/code-rhel9:1782498475" }, { "product_name" : "Red Hat OpenShift Dev Spaces 3.29", "release_date" : "2026-07-08T00:00:00Z", "advisory" : "RHSA-2026:36820", "cpe" : "cpe:/a:redhat:openshift_devspaces:3.29::el9", "package" : "devspaces/dashboard-rhel9:1782498792" }, { "product_name" : "Red Hat OpenShift Service Mesh 2.6", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33155", "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8", "package" : "openshift-service-mesh/kiali-ossmc-rhel8:1781937133" }, { "product_name" : "Red Hat OpenShift Service Mesh 2.6", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33155", "cpe" : "cpe:/a:redhat:service_mesh:2.6::el8", "package" : "openshift-service-mesh/kiali-rhel8:1782287580" }, { "product_name" : "Red Hat OpenShift Service Mesh 3.0", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33160", "cpe" : "cpe:/a:redhat:service_mesh:3.0::el9", "package" : "openshift-service-mesh/kiali-ossmc-rhel9:1782201894" }, { "product_name" : "Red Hat OpenShift Service Mesh 3.0", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33160", "cpe" : "cpe:/a:redhat:service_mesh:3.0::el9", "package" : "openshift-service-mesh/kiali-rhel9:1782201833" }, { "product_name" : "Red Hat OpenShift Service Mesh 3.1", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33163", "cpe" : "cpe:/a:redhat:service_mesh:3.1::el9", "package" : "openshift-service-mesh/kiali-ossmc-rhel9:1782201696" }, { "product_name" : "Red Hat OpenShift Service Mesh 3.1", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33163", "cpe" : "cpe:/a:redhat:service_mesh:3.1::el9", "package" : "openshift-service-mesh/kiali-rhel9:1782201537" }, { "product_name" : "Red Hat OpenShift Service Mesh 3.2", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33173", "cpe" : "cpe:/a:redhat:service_mesh:3.2::el9", "package" : "openshift-service-mesh/kiali-ossmc-rhel9:1782201851" }, { "product_name" : "Red Hat OpenShift Service Mesh 3.2", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33173", "cpe" : "cpe:/a:redhat:service_mesh:3.2::el9", "package" : "openshift-service-mesh/kiali-rhel9:1782201812" }, { "product_name" : "Red Hat OpenShift Service Mesh 3.3", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33183", "cpe" : "cpe:/a:redhat:service_mesh:3.3::el9", "package" : "openshift-service-mesh/kiali-ossmc-rhel9:1782231869" }, { "product_name" : "Red Hat OpenShift Service Mesh 3.3", "release_date" : "2026-06-29T00:00:00Z", "advisory" : "RHSA-2026:33183", "cpe" : "cpe:/a:redhat:service_mesh:3.3::el9", "package" : "openshift-service-mesh/kiali-rhel9:1782201466" } ], "package_state" : [ { "product_name" : "Confidential Compute Attestation", "fix_state" : "Affected", "package_name" : "openshift-sandboxed-containers/osc-pccs", "cpe" : "cpe:/a:redhat:confidential_compute_attestation:1" }, { "product_name" : "Cryostat 4", "fix_state" : "Not affected", "package_name" : "cryostat/cryostat-openshift-console-plugin-rhel9", "cpe" : "cpe:/a:redhat:cryostat:4" }, { "product_name" : "Cryostat 4", "fix_state" : "Not affected", "package_name" : "cryostat-openshift-console-plugin-npm", "cpe" : "cpe:/a:redhat:cryostat:4" }, { "product_name" : "Exploit Intelligence", "fix_state" : "Affected", "package_name" : "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9", "cpe" : "cpe:/a:redhat:exploit_intelligence:0" }, { "product_name" : "Multicluster Engine for Kubernetes", "fix_state" : "Will not fix", "package_name" : "multicluster-engine/console-mce-rhel9", "cpe" : "cpe:/a:redhat:multicluster_engine" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Affected", "package_name" : "openshift-pipelines/pipelines-console-plugin-rhel8", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "OpenShift Pipelines", "fix_state" : "Affected", "package_name" : "openshift-pipelines/pipelines-console-plugin-rhel9", "cpe" : "cpe:/a:redhat:openshift_pipelines:1" }, { "product_name" : "Red Hat Advanced Cluster Management for Kubernetes 2", "fix_state" : "Not affected", "package_name" : "rhacm2/console-rhel9", "cpe" : "cpe:/a:redhat:acm:2" }, { "product_name" : "Red Hat AMQ Broker 7", "fix_state" : "Affected", "package_name" : "ip-address", "cpe" : "cpe:/a:redhat:amq_broker:7" }, { "product_name" : "Red Hat build of Apache Camel for Spring Boot 4", "fix_state" : "Not affected", "package_name" : "ip-address", "cpe" : "cpe:/a:redhat:camel_spring_boot:4" }, { "product_name" : "Red Hat build of Apache Camel - HawtIO 4", "fix_state" : "Will not fix", "package_name" : "ip-address", "cpe" : "cpe:/a:redhat:apache_camel_hawtio:4" }, { "product_name" : "Red Hat Build of Podman Desktop", "fix_state" : "Affected", "package_name" : "rh-podman-desktop.git", "cpe" : "cpe:/a:redhat:podman_desktop:1" }, { "product_name" : "Red Hat Build of Podman Desktop - Tech Preview", "fix_state" : "Will not fix", "package_name" : "rhdesktop/rh-podman-desktop-ext-sandbox-rhel10", "cpe" : "cpe:/a:redhat:podman_desktop:0" }, { "product_name" : "Red Hat Enterprise Linux 10", "fix_state" : "Not affected", "package_name" : "rust", "cpe" : "cpe:/o:redhat:enterprise_linux:10" }, { "product_name" : "Red Hat Enterprise Linux 9", "fix_state" : "Not affected", "package_name" : "rust", "cpe" : "cpe:/o:redhat:enterprise_linux:9" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-cuda-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-gaudi-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/bootc-rocm-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rhelai3/disk-image-cuda-rhel9", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3", "fix_state" : "Affected", "package_name" : "rust", "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3" }, { "product_name" : "Red Hat Hardened Images", "fix_state" : "Affected", "package_name" : "rust", "cpe" : "cpe:/a:redhat:hummingbird:1" }, { "product_name" : "Red Hat OpenShift AI (RHOAI)", "fix_state" : "Affected", "package_name" : "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "cpe" : "cpe:/a:redhat:openshift_ai" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Affected", "package_name" : "openshift4/ose-agent-installer-ui-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Container Platform 4", "fix_state" : "Affected", "package_name" : "openshift4/ose-console-rhel9", "cpe" : "cpe:/a:redhat:openshift:4" }, { "product_name" : "Red Hat OpenShift Dev Spaces", "fix_state" : "Not affected", "package_name" : "devspaces/openvsx-rhel9", "cpe" : "cpe:/a:redhat:openshift_devspaces:3" }, { "product_name" : "Red Hat Satellite 6", "fix_state" : "Affected", "package_name" : "satellite/iop-remediations-rhel9", "cpe" : "cpe:/a:redhat:satellite:6" }, { "product_name" : "Self-service automation portal 2", "fix_state" : "Affected", "package_name" : "ansible-automation-platform/automation-portal", "cpe" : "cpe:/a:redhat:ansible_portal:2" } ], "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-42338\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42338\nhttps://github.com/beaugunderson/ip-address/security/advisories/GHSA-v2v4-37r5-5v8g" ], "name" : "CVE-2026-42338", "mitigation" : { "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "lang" : "en:us" }, "csaw" : false }