This advisory covers Red Hat Advanced Cluster Management for Kubernetes 2.11.4 container images which fix multiple security issues: CVE-2024-45296 involves a ReDoS vulnerability caused by backtracking regular expressions; CVE-2024-45813 is a ReDoS vulnerability in multiparametric routes; and CVE-2024-45801 is an XSS vulnerability via prototype pollution. The update also fixes various bugs affecting policy status updates, operator installation, certificate policy expiration, image pull secrets retrieval, and alertmanager behavior. The advisory references Red Hat's official errata RHSA-2024:11381 and release notes for detailed information.

The vulnerabilities fixed in this release could allow denial of service through regular expression backtracking and cross-site scripting attacks via prototype pollution. These issues may affect the stability and security of the cluster management environment. The severity is rated moderate, indicating a significant but not critical risk. No known exploits in the wild have been reported at this time.

Red Hat has released version 2.11.4 of Advanced Cluster Management for Kubernetes which includes fixes for these vulnerabilities. Users should apply this update after ensuring all prior errata are applied. The vendor advisory does not indicate that no action is required or that the issues are already mitigated, so updating to the fixed version is recommended to address these security concerns.