Red Hat Trusted Profile Analyzer versions >=1.1.2 and <1.2.0 are affected by security vulnerabilities tracked under CVE-2024-45296 and CVE-2024-45590. The Red Hat Product Security advisory RHSA-2024:9885 recommends upgrading to version 1.2.0, which includes significant data model changes and a migration utility. The advisory does not specify explicit fixes for the CVEs but classifies the update as having a Moderate security impact. No CVSS score is provided. There are no known exploits in the wild. The vulnerabilities relate to CWEs 1333 and 405, indicating issues with improper handling of certain conditions and potential use-after-free or double-free scenarios.

The vulnerabilities in versions prior to 1.2.0 may allow attackers to exploit weaknesses related to improper resource management or data handling as indicated by the associated CWEs. The advisory rates the impact as Moderate, suggesting that while the vulnerabilities are significant, they are not critical or actively exploited. No known exploits have been reported in the wild.

Red Hat recommends that users of Red Hat Trusted Profile Analyzer version 1.1.2 upgrade to version 1.2.0. A migration utility is available to assist with the upgrade due to significant changes in the data model. Users should follow the official Red Hat release notes and upgrade instructions. Patch status is confirmed by the vendor advisory, indicating that upgrading to 1.2.0 is the official fix.