Red Hat Openshift Dev Spaces
Monthly
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Arbitrary VS Code command execution in the Red Hat vscode-java extension allows a malicious Java source file to embed hidden commands inside JavaDoc hover Markdown, so that a developer who simply clicks a crafted link in a hover popup triggers attacker-chosen commands that can escalate to full system compromise in trusted workspaces. The flaw stems from the extension rendering JavaDoc hovers as fully-trusted Markdown, and it also affects Red Hat OpenShift Dev Spaces, which bundles the extension. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network reach combined with only a single click of user interaction makes it high-impact.
A path-handling flaw in the containers/storage Go library lets a crafted tar archive containing a malicious whiteout entry (for example 'victim/.wh.') cause UnpackLayer, ApplyLayer, or ApplyUncompressedLayer to replace the extraction destination directory with an arbitrary file. Systems that unpack container image layers with this library — notably Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, OpenShift Container Platform 4, Quay 3, OpenShift Virtualization, Dev Spaces, and Red Hat Hardened Images — are in scope. Exploitation requires the operator or process to unpack an attacker-supplied archive, and the integrity impact is confined to the local extraction target; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the modest CVSS 3.1 base score of 4.4.
We need to synthesize a JSON analysis. Let's parse. CVE-2026-79705: flaw in buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected. CVSS 4.5: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N. Interesting — AV:N but PR:H (high privileges) and UI:R (user interaction). So the attacker needs high privileges and user interaction. Actually "non-root caller" — so the copier package is used by a non-root caller outside Buildah. PR:H suggests high privileges required (the attacker needs to be the caller with high privileges? Or the vulnerable component runs with high privileges?). Hmm. CVSS vector: AV:N, AC:L, PR:H, UI:R, S:U, C:N, I:H, A:N. Base score 4.5 (with PR:H, UI:R). Actually let's compute: AV:N (0.85), AC:L (0.77), PR:H (0.27), UI:R (0.62), C:N, I:H (0.56), A:N. Score = 4.5? Let me check. Impact = 1-(1-0)(1-0.56)(1-0) = 0.56. Impact sub = 6.42*0.56 = 3.5952. Exploitability = 8.22*0.85*0.77*0.27*0.62 = 8.22*0.85=6.987; *0.77=5.38; *0.27=1.4526; *0.62=0.9006. Scope unchanged, so base = roundup(min(3.5952+0.9006, 10)) = 4.4958 → 4.5 (roundup: 4.5). Yes matches. CWE-22: Path Traversal (Improper Limitation of a Pathname to a Restricted Directory). Tar archive symlink escape — zip slip / symlink traversal. CPE: red_hat_ansible_automation_platform_2 (multiple), red_hat_enterprise_linux_10. Tags include many Red Hat products: RHEL 8/9/10, OpenShift Container Platform 4, Ansible Automation Platform 2, Quay 3, Hardened Images, OpenShift Virtualization 4, OpenShift Dev Spaces. No EPSS given, no KEV, no POC mentioned. So exploitation status: "no public exploit identified at time of analysis". Patch status: no fix version given in input. References: Red Hat CVE page and Bugzilla. No patch data. So "No vendor-released patch identified at time of analysis"?
Memory exhaustion denial of service in cockpit-ws affects Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Dev Spaces, exploitable by any remote unauthenticated attacker. The login page request handler leaks a heap allocation on every HTTP request that includes a CockpitLang cookie, with no authentication or special privilege required. Sustained request flooding with this cookie will exhaust host memory, crashing the cockpit-ws service and potentially destabilizing the underlying host; no public exploit or active exploitation has been identified at time of analysis.
Arbitrary VS Code command execution in the Red Hat vscode-java extension allows a malicious Java source file to embed hidden commands inside JavaDoc hover Markdown, so that a developer who simply clicks a crafted link in a hover popup triggers attacker-chosen commands that can escalate to full system compromise in trusted workspaces. The flaw stems from the extension rendering JavaDoc hovers as fully-trusted Markdown, and it also affects Red Hat OpenShift Dev Spaces, which bundles the extension. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the network reach combined with only a single click of user interaction makes it high-impact.
A path-handling flaw in the containers/storage Go library lets a crafted tar archive containing a malicious whiteout entry (for example 'victim/.wh.') cause UnpackLayer, ApplyLayer, or ApplyUncompressedLayer to replace the extraction destination directory with an arbitrary file. Systems that unpack container image layers with this library — notably Red Hat Enterprise Linux 10, Red Hat Ansible Automation Platform 2, OpenShift Container Platform 4, Quay 3, OpenShift Virtualization, Dev Spaces, and Red Hat Hardened Images — are in scope. Exploitation requires the operator or process to unpack an attacker-supplied archive, and the integrity impact is confined to the local extraction target; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, consistent with the modest CVSS 3.1 base score of 4.4.
We need to synthesize a JSON analysis. Let's parse. CVE-2026-79705: flaw in buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected. CVSS 4.5: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N. Interesting — AV:N but PR:H (high privileges) and UI:R (user interaction). So the attacker needs high privileges and user interaction. Actually "non-root caller" — so the copier package is used by a non-root caller outside Buildah. PR:H suggests high privileges required (the attacker needs to be the caller with high privileges? Or the vulnerable component runs with high privileges?). Hmm. CVSS vector: AV:N, AC:L, PR:H, UI:R, S:U, C:N, I:H, A:N. Base score 4.5 (with PR:H, UI:R). Actually let's compute: AV:N (0.85), AC:L (0.77), PR:H (0.27), UI:R (0.62), C:N, I:H (0.56), A:N. Score = 4.5? Let me check. Impact = 1-(1-0)(1-0.56)(1-0) = 0.56. Impact sub = 6.42*0.56 = 3.5952. Exploitability = 8.22*0.85*0.77*0.27*0.62 = 8.22*0.85=6.987; *0.77=5.38; *0.27=1.4526; *0.62=0.9006. Scope unchanged, so base = roundup(min(3.5952+0.9006, 10)) = 4.4958 → 4.5 (roundup: 4.5). Yes matches. CWE-22: Path Traversal (Improper Limitation of a Pathname to a Restricted Directory). Tar archive symlink escape — zip slip / symlink traversal. CPE: red_hat_ansible_automation_platform_2 (multiple), red_hat_enterprise_linux_10. Tags include many Red Hat products: RHEL 8/9/10, OpenShift Container Platform 4, Ansible Automation Platform 2, Quay 3, Hardened Images, OpenShift Virtualization 4, OpenShift Dev Spaces. No EPSS given, no KEV, no POC mentioned. So exploitation status: "no public exploit identified at time of analysis". Patch status: no fix version given in input. References: Red Hat CVE page and Bugzilla. No patch data. So "No vendor-released patch identified at time of analysis"?