This advisory covers two security vulnerabilities in the Red Hat build of Cryostat 3 on RHEL 8. The first, CVE-2024-43788, is a DOM Clobbering vulnerability in webpack's AutoPublicPathRuntimeModule, which can lead to unintended manipulation of DOM elements. The second, CVE-2024-45801, is a cross-site scripting (XSS) vulnerability caused by prototype pollution in dompurify, a library used for sanitizing HTML. Red Hat has rated these vulnerabilities as moderate in severity and has released an update to address them. The advisory references the specific bugzilla entries and CVE pages for further technical details.

The vulnerabilities could allow an attacker to manipulate the Document Object Model (DOM) or execute cross-site scripting attacks in environments using the affected Cryostat build. This could potentially lead to unauthorized script execution or manipulation of web content. However, Red Hat classifies the overall impact as moderate, indicating that while the vulnerabilities are significant, they are not considered critical or high severity.

Red Hat has released an official security update for the Red Hat build of Cryostat 3 on RHEL 8 that addresses these vulnerabilities. Users should apply this update after ensuring all previously released errata relevant to their system have been installed. Detailed instructions for applying the update are available in the Red Hat advisory and knowledge base article referenced. No additional mitigation steps are indicated or required beyond applying the official update.