huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-6622: kernel: null pointer dereference vulnerability in nft_dynset_init()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-12-08T11:56:00+00:00

A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.

Statement: To trigger the issue, it requires the ability to create user/net namespaces.

On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:

~~~ 
echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf
sysctl -p /etc/sysctl.d/userns.conf
~~~
On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation, as the functionality is needed to be enabled.

Affected upstream versions: <= v6.6
Fixed upstream versions: 0:4.18.0-553.el8_10, 0:4.18.0-553.rt7.342.el8_10, 0:5.14.0-427.13.1.el9_4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 3701cd390fd731ee7ae8b8006246c8db82c72bea
CVE-2023-6817: kernel: inactive elements in nft_pipapo_walk
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-12-18T00:00:00+00:00

A use-after-free flaw was found in the Netfilter subsystem in the Linux kernel via the nft_pipapo_walk function. This issue may allow a local user with CAP_NET_ADMIN capability to trigger an application crash, information disclosure, or local privilege escalation.

Statement: Only local users with `CAP_NET_ADMIN` capability or root can trigger this issue. 
On Red Hat Enterprise Linux, local unprivileged users can exploit unprivileged user namespaces (CONFIG_USER_NS) to grant themselves this capability.

The OpenShift Container Platform (OCP) control planes or master machines are based on Red Hat Enterprise Linux CoreOS (RHCOS) that consists primarily of RHEL components, therefore, it is also affected by this kernel vulnerability. A successful exploit needs necessary privileges (CAP_NET_ADMIN) and direct, local access. A local user in RHCOS is already a root with full permissions, hence existence of this vulnerability does not bring any value from the potential attacker perspective. From the OpenShift containers perspective, this vulnerability cannot be exploited as in OpenShift the cluster processes on the node are namespaced, which means that switching the namespace in the running OpenShift container will not bring necessary capabilities.
This means that for OpenShift, the impact of this vulnerability is Low.

Similar to the CVE-2023-32233 vulnerability, this has been explained in the following blog post as an example of a "Container escape vulnerability":
https://www.redhat.com/en/blog/containers-vulnerability-risk-assessment

Affected upstream versions: 5.6 < 6.7
Fixed upstream versions: 6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 317eb9685095678f2c9f5a8189de698c5354316a
CVE-2023-6915: kernel: Null Pointer Dereference vulnerability in ida_free in lib/idr.c
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-01-15T00:00:00+00:00

A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.


Affected upstream versions: <= v6.6
Fixed upstream versions: 0:4.18.0-553.el8_10, 0:4.18.0-553.rt7.342.el8_10, 0:5.14.0-427.13.1.el9_4
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: af73483f4e8b6f5c68c9aa63257bdd929a9c194a
CVE-2023-6931: kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-11-29T00:00:00+00:00

A flaw was found in the Linux kernel's Performance Events system component. A condition can be triggered that allows data to be written past the end or before the beginning of the intended memory buffer. This may lead to a system crash, code execution, or local privilege escalation.


Affected upstream versions: 4.3 < 6.7
Fixed upstream versions: 6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 382c27f4ed28f803b1f1473ac2d8db0afc795a1b
CVE-2023-6932: kernel: use-after-free in IPv4 IGMP
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-12-19T00:00:00+00:00

A race condition has been discovered in the Linux kernel's Internet Group Management Protocol (IGMP) implementation. This vulnerability may enable an attacker to provoke an application crash or potentially escalate privileges locally. By exploiting the race condition, an adversary could disrupt the normal operation of affected systems, leading to service disruption or, in the worst case, unauthorized access to sensitive resources.

Statement: This vulnerability poses a moderate severity risk due to its potential to trigger a use-after-free issue when processing IGMPv2 query packets under specific conditions. An attacker could exploit this flaw by continuously sending crafted IGMPv2 query packets to a vulnerable system, causing a reference count underflow in the multicast group list management. Subsequently, this could lead to a use-after-free scenario, potentially resulting in a denial-of-service condition or other adverse effects. While exploitation requires specific configurations and continuous packet transmission, the impact could be significant, warranting attention and remediation to prevent potential exploitation and system instability.

Affected upstream versions: 2.6.12 < 6.7
Fixed upstream versions: 6.7
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: e2b706c691905fe78468c361aaabc719d0a496f1
CVE-2023-7192: kernel: refcount leak in ctnetlink_create_conntrack()
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-10T00:00:00+00:00

A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.


Affected upstream versions: <= v6.1
Fixed upstream versions: 0:4.18.0-193.133.1.el8_2, 0:4.18.0-193.133.1.rt13.184.el8_2, 0:4.18.0-305.125.1.el8_4, 0:4.18.0-305.125.1.rt7.201.el8_4, 0:4.18.0-372.95.1.el8_6, 0:4.18.0-477.51.1.el8_8, 0:5.14.0-284.52.1.el9_2, 0:5.14.0-284.52.1.rt14.337.el9_2, 0:5.14.0-70.93.1.rt21.165.el9_0, 0:5.14.0-70.93.2.el9_0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
Upstream fix commit: ac4893980bbe79ce383daf9a0885666a30fe4c83
CVE-2024-0397: cpython: python: Memory race condition in ssl.SSLContext certificate store methods
Component: cpython
Severity: Low
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2024-06-17T00:00:00+00:00

A vulnerability was found in Python. A defect was discovered in the Python “ssl” module where there is a memory race condition with the ssl.SSLContext methods “cert_store_stats()” and “get_ca_certs()”. The race condition can be triggered if the methods are called at the same time that certificates are loaded into the SSLContext, such as during the TLS handshake with a  configured certificate directory.

Statement: This vulnerability is classified as low severity instead of moderate because it primarily results in a race condition that can cause unexpected behavior or crashes but does not directly lead to memory corruption, information disclosure, or remote code execution. 

The issue is constrained to scenarios where multiple threads interact with SSLContext during certificate loading, which is an uncommon pattern in typical applications. Additionally, exploitation would require precise timing and a specific application design that exposes these methods to concurrent access, reducing the likelihood of real-world impact.

Affected upstream versions: 3.9.0 < 3.9.20, 3.10.0 < 3.10.14, 3.11.0 < 3.11.9, 3.12.0 < 3.12.3, 3.13.0a1 < 3.13.0a5
Fixed upstream versions: v3.11.9
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 01c37f1d0714f5822d34063ca7180b595abf589d
CVE-2024-0444: gstreamer: AV1 Video Parsing Stack-based Buffer Overflow
Component: gstreamer
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2024-06-07T00:00:00+00:00

A stack-based buffer overflow flaw was found in GStreamer. This issue may lead to code execution while parsing tile list data within AV1-encoded video files.

Statement: Despite the potential for remote code execution, the CVE-2024-0444 vulnerability in GStreamer is classified with a Moderate severity due to the high attack complexity (AC) and the requirement for user interaction (UI). Exploitation of this vulnerability is not straightforward; an attacker must craft a specific AV1-encoded video file and persuade a user to process it with the vulnerable GStreamer implementation. Additionally, the need for precise manipulation of stack-based buffer operations to achieve arbitrary code execution adds further complexity, reducing the likelihood of successful exploitation in real-world scenarios. The requirement for user interaction and the high complexity barrier mitigate the overall risk, hence the Moderate severity rating.

Affected upstream versions: ea6d602ccacee5f4bdf45b9f58eb0dc5320f3c07
Fixed upstream versions: 1.23.1
Upstream repository: https://gitlab.freedesktop.org/gstreamer/gstreamer
Upstream fix commit: f368d63ecd89e01fd2cf0b1c4def5fc782b2c390
CVE-2024-0450: python: The zipfile module is vulnerable to zip-bombs leading to denial of service
Component: python
Severity: Moderate
CWE: CWE-450 (Multiple Interpretations of UI Input)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-03-19T00:00:00+00:00

A flaw was found in the Python/CPython 'zipfile' that can allow a zip-bomb type of attack. An attacker may craft a zip file format, leading to a Denial of Service when processed.

Statement: Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.9.0 < 3.9.19, 3.10.0 < 3.10.14, 3.11.0 < 3.11.8, 3.12.0 < 3.12.2, 3.13.0a1 < 3.13.0a3
Fixed upstream versions: v3.13.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 66363b9a7b9fe7c99eba3a185b74c5fdbf842eba
CVE-2024-0639: kernel: potential deadlock on &net->sctp.addr_wq_lock leading to DOS
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-06-27T00:00:00+00:00

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.


Affected upstream versions: <= v6.4
Fixed upstream versions: 0:5.14.0-362.8.1.el9_3, 6.5-rc1
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 6feb37b3b06e9049e20dcf7e23998f92c9c5be9a
CVE-2024-0646: kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-12-07T06:30:00+00:00

An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: <= v6.6
Fixed upstream versions: 0:4.18.0-193.128.1.el8_2, 0:4.18.0-193.128.1.rt13.179.el8_2, 0:4.18.0-305.125.1.el8_4, 0:4.18.0-305.125.1.rt7.201.el8_4, 0:4.18.0-372.91.1.el8_6, 0:4.18.0-477.51.1.el8_8, 0:4.18.0-513.18.1.el8_9, 0:4.18.0-513.18.1.rt7.320.el8_9, 0:5.14.0-284.52.1.el9_2, 0:5.14.0-284.52.1.rt14.337.el9_2, 0:5.14.0-362.24.1.el9_3, 0:5.14.0-70.93.1.rt21.165.el9_0, 0:5.14.0-70.93.2.el9_0, 6.7-rc5, v0.1.0-224, v0.1.0-525, v0.28.1-56, v0.4.0-247, v1.0.0-479, v1.1.0-227
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: c5a595000e267
CVE-2024-0727: openssl: denial of service via null dereference
Component: openssl
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-01-22T00:00:00+00:00

A flaw was found in OpenSSL. The optional ContentInfo fields can be set to null, even if the "type" is a valid value, which can lead to a null dereference error that may cause a denial of service.

Statement: This vulnerability is classified as low severity. This is a result of a lack of proper validation in OpenSSL's handling of PKCS12 files. This vulnerability results in a potential Denial of Service scenario wherein maliciously crafted PKCS12 files may cause OpenSSL to crash due to a NULL pointer dereference. However, the impact of this issue is reduced by the fact that exploitation requires processing PKCS12 files from untrusted sources using specific OpenSSL APIs, such as PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes(), and PKCS12_newpass(). Furthermore, while a similar issue was addressed in SMIME_write_PKCS7(), its relevance is diminished as it pertains to writing data rather than parsing, hence not considered security significant. The risk of this vulnerability is limited as Red Hat offerings do not utilize images from untrusted sources by default.

Affected upstream versions: 3.2.0 < 3.2.1, 3.1.0 < 3.1.5, 3.0.0 < 3.0.13, 1.1.1 < 1.1.1x, 1.0.2 < 1.0.2zj
Fixed upstream versions: 1.0.2zj, 1.1.1x, 3.0.13, 3.1.5, 3.2.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 775acfdbd0c6af9ac855f34969cdab0c0c90844a
CVE-2024-10270: org.keycloak:keycloak-services: Keycloak Denial of Service
Component: org.keycloak
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-11-21T16:54:00+00:00

A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

Statement: Red Hat Enterprise Application Platform 8 does not ship or provide the affected component, and so is not affected by this flaw.

Affected upstream versions: 25.0.0 < 26.0.6
Fixed upstream versions: 24-18, 24.0.9, 24.0.9-1, 26.0-5, 26.0-6, 26.0.6, 26.0.6-2
Upstream repository: https://github.com/keycloak/keycloak
Upstream fix commit: 5d6c91f3309db468b0fe4834e88c3d25649f73e4
CVE-2024-1085: kernel: nf_tables: use-after-free vulnerability in the nft_setelem_catchall_deactivate() function
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-01-31T00:00:00+00:00

A double-free flaw was found in how the Linux kernel's NetFilter system marks whether a catch-all element is enabled. A local user could use this flaw to crash the system.

Statement: This flaw is rated as a having Moderate impact, because it can only be exploited by a local user with access to netfilter.

Affected upstream versions: 5.13 < 6.8
Fixed upstream versions: 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7
CVE-2024-1086: kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-01-31T00:00:00+00:00

A flaw was found in the Netfilter subsystem in the Linux kernel. This issue occurs in the nft_verdict_init() function, allowing positive values as a drop error within the hook verdict, therefore, the nf_hook_slow() function can cause a double-free vulnerability when NF_DROP is issued with a drop error that resembles NF_ACCEPT. The nf_tables component can be exploited to achieve local privilege escalation.

Statement: This flaw is rated as having an Important impact. There is the limitation that it can only be exploited by a local user with access to Netfilter, but can still allow privilege escalation if user namespaces are enabled and Netfilter is being used.

Affected upstream versions: 3.15 < 6.8
Fixed upstream versions: 6.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: f342de4e2f33e0e39165d8639387aa6c19dff660
CVE-2024-11168: python: Improper validation of IPv6 and IPvFuture addresses
Component: python
Severity: Moderate
CWE: CWE-1287 (Improper Validation of Specified Type of Input)
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2024-11-12T21:22:23.438000+00:00

A flaw was found in Python. The `urllib.parse.urlsplit()` and `urlparse()` functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture compliant. This behavior was not conformant to RFC 3986 and was potentially vulnerable to server-side request forgery (SSRF) if a URL is processed by more than one URL parser.


Affected upstream versions: 3.10.0 < 3.10.16, 3.11.0 < 3.11.4, 3.12.0a1 < 3.12.0b1
Fixed upstream versions: v3.12.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 29f348e232e82938ba2165843c448c2b291504c5
CVE-2024-1135: python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers
Component: python-gunicorn
Severity: Important
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2024-04-15T00:00:00+00:00

An HTTP Request Smuggling vulnerability was found in Gunicorn. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks, including cache poisoning, session manipulation, and data exposure.


Affected upstream versions: unspecified <= latest
Fixed upstream versions: 22.0.0
Upstream repository: https://github.com/benoitc/gunicorn
Upstream fix commit: ac29c9b0a758d21f1e0fb3b3457239e523fa9f1d
CVE-2024-11407: grpc: Denial of Service through Data corruption in gRPC-C++
Component: grpc
Severity: Moderate
CWE: CWE-682 (Incorrect Calculation)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-11-26T16:59:49.718000+00:00

A flaw was found in gRPC. In certain configurations, the data sent by the application may be corrupted before transmission over the network, leaving the recipient with an incorrect set of bytes, which will cause RPC requests to fail. This issue may lead to a denial of service.


Affected upstream versions: 1.60.0 <= 1.66.1
Fixed upstream versions: v1.68.0
Upstream repository: https://github.com/grpc/grpc
Upstream fix commit: e9046b2bbebc0cb7f5dc42008f807f6c7e98e791
CVE-2024-11483: automation-gateway: aap-gateway: Improper Scope Handling in OAuth2 Tokens for AAP 2.5
Component: automation-gateway
Severity: Moderate
CWE: CWE-284 (Improper Access Control)
CVSS v3: 5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N)
Public date: 2024-11-20T00:00:00+00:00

A vulnerability was found in the Ansible Automation Platform (AAP). This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansible_base.oauth2_provider for OAuth2 authentication. While the impact is limited to actions within the user’s assigned permissions, it undermines scoped access controls, potentially allowing unintended modifications in the application and consuming services.


Affected upstream versions: <= 2024.10.17
Fixed upstream versions: 0:2.5.20241218-1.el8ap, 0:2.5.20241218-1.el9ap
Upstream repository: https://github.com/ansible/django-ansible-base
Upstream fix commit: 845b3e1838cc0762a7f9f3e0379c5274519d9a44
CVE-2024-11831: npm-serialize-javascript: Cross-site Scripting (XSS) in serialize-javascript
Component: npm-serialize-javascript
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Public date: 2024-09-16T00:00:00+00:00

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.


Affected upstream versions: 6.0 < 6.0.2
Fixed upstream versions: 0:8.0.112-1.el8_10, 0:8.0.112-1.el9_5, 1776359884, 2:18.2.1-381.el8cp, 2:19.2.1-292.el9cp, 2:20.1.0-144.el10cp, 4.4.8-2, 4.5.6-2, 6.0.2, 8, v1.14.6-1744143767, v1.15.3-1746936251, v1.15.3-1746939886, v1.16.4-1747979846, v1.16.4-1747983385, v1.17.2-1749452800, v1.17.2-1750066936, v1.18.1-1747749913, v1.19.0-1752127853, v4.14.18-2
Upstream repository: https://github.com/yahoo/serialize-javascript
Upstream fix commit: f27d65d3de42affe2aac14607066c293891cec4e