The security advisory for Red Hat Advanced Cluster Management for Kubernetes addresses several vulnerabilities, including CVE-2025-7195, a prototype pollution flaw in Lodash's _.unset and _.omit functions. This flaw allows an attacker controlling property paths to delete methods from global prototypes, potentially causing denial of service by removing essential functionalities. The vulnerability requires that user input controls the property path passed to these functions. The advisory provides updated container images in version 2.12.8 that include fixes and enhancements. The vulnerability affects versions >=2.12.0 and <2.12.8. Red Hat's analysis indicates the impact is limited to denial of service, with no confidentiality or integrity compromise. No active exploitation is known. The vendor advisory recommends applying the update to 2.12.8 and ensuring prior errata are applied.

The primary impact of the prototype pollution vulnerability (CVE-2025-7195) is denial of service by deleting methods from global prototypes, which can disrupt application functionality. There is no reported impact on confidentiality or integrity. The vulnerability is exploitable only if user input controls property paths passed to Lodash functions. No known exploits are currently active in the wild. Other CVEs addressed in the update may have varying impacts, but the overall severity is rated high due to the potential for denial of service and other issues fixed in the update.

A fixed version (2.12.8) of Red Hat Advanced Cluster Management for Kubernetes is available and should be applied. Before updating, ensure all previously released errata relevant to your system are installed. The vendor advisory provides detailed instructions for applying the update. Additionally, to mitigate the Lodash prototype pollution vulnerability, implement strict input validation to block user input that attempts to manipulate prototype properties such as __proto__, constructor, and prototype. No other specific mitigations are indicated by the vendor advisory.