This advisory for Red Hat Advanced Cluster Management for Kubernetes 2.12.1 addresses two ReDoS vulnerabilities: CVE-2024-45296 caused by backtracking regular expressions, and CVE-2024-45813 involving multiparametric routes. These vulnerabilities could allow an attacker to cause denial of service by exploiting inefficient regular expression processing. The update includes bug fixes and container image updates to remediate these issues. The affected versions are >=2.12.0 and <2.12.1. No CVSS scores are provided, but the vendor rates the impact as moderate. There are no known exploits in the wild at the time of the advisory. The vendor advisory is the authoritative source for remediation.

Successful exploitation of these vulnerabilities could lead to denial of service conditions due to resource exhaustion from inefficient regular expression processing. This could impact availability of the Red Hat Advanced Cluster Management for Kubernetes service. No information is provided about privilege escalation or data compromise. The impact is rated moderate by Red Hat Product Security.

Apply the Red Hat Advanced Cluster Management for Kubernetes 2.12.1 update, which contains fixes for these ReDoS vulnerabilities. Before updating, ensure all previously released errata relevant to your system are applied. No additional mitigation steps are indicated by the vendor advisory.