CVE-2024-45338 is a vulnerability in the golang.org/x/net/html package that causes non-linear parsing of case-insensitive content, impacting Red Hat OpenShift API for Data Protection (OADP) and related Red Hat products such as Red Hat Developer Hub and Red Hat OpenShift AI. This issue is part of a set of security fixes released by Red Hat in their 1.3.7 update for OADP and version 2.16.0 for Red Hat OpenShift AI. The vulnerability is rated critical by Red Hat Product Security. The advisory references multiple related CVEs and provides updated container images and operator bundles to address the issue. The vulnerability affects versions >=1.3.0 and <1.3.7 of OADP and version 1.4.x of Red Hat Developer Hub. No active exploitation has been reported.

The vulnerability allows improper parsing of HTML content which could lead to unexpected behavior or security issues in the affected components. Given the critical severity rating by Red Hat, the impact could be significant in environments using affected versions of OADP, Red Hat Developer Hub, and Red Hat OpenShift AI. However, no known exploits in the wild have been reported at this time.

Red Hat has released official fixes for this vulnerability. Users should apply the OpenShift API for Data Protection (OADP) 1.3.7 update and upgrade Red Hat OpenShift AI to version 2.16.0. The advisories provide updated container images and operator bundles. Before applying these updates, ensure all previously released errata relevant to your system have been applied. Follow the detailed upgrade instructions provided by Red Hat in their advisories and documentation. No additional mitigation is required beyond applying these official updates.