The Red Hat security advisory for the multicluster engine for Kubernetes (CVE-2024-45336 and others) addresses several vulnerabilities including a flaw in golang's net/http package where sensitive headers are incorrectly sent after cross-domain redirects. Additional fixes cover an ICMP Packet Too Large Injection Attack in quic-go (CVE-2024-53259), timing sidechannels in crypto/internal/nistec, and memory consumption issues in golang OAuth2 and JWT libraries. These vulnerabilities affect Red Hat Advanced Cluster Management for Kubernetes versions 2.11 and 2.12 on RHEL 9 for multiple CPU architectures (x86_64, s390x, ppc64le, aarch64). The advisory includes updated container images for Submariner components that facilitate networking across Kubernetes clusters. Red Hat has released patches and updated images to address these issues. No active exploitation has been reported. The advisory references multiple CVEs and provides links to Red Hat errata for further details.

The vulnerabilities fixed in this advisory could lead to unintended disclosure of sensitive HTTP headers after cross-domain redirects, potential injection attacks via ICMP packets, timing side channels in cryptographic operations, and excessive memory consumption during token parsing. These issues could compromise confidentiality and stability of cluster management operations. Given the high severity rating by Red Hat, these flaws represent significant risks to the security posture of Kubernetes cluster management environments using the affected versions of Red Hat Advanced Cluster Management for Kubernetes.

Red Hat has released official security updates and fixed container images for Red Hat Advanced Cluster Management for Kubernetes versions 2.11 and 2.12 on RHEL 9. Users should apply these updates promptly to remediate the vulnerabilities. The vendor advisory indicates that updated Submariner container images are available and should be deployed as part of the remediation. There are no indications that no action is required or that the issues are already mitigated without patching. Patch status is confirmed as official-fix via Red Hat errata RHSA-2025:4810 and related advisories. Users should follow Red Hat's guidance and update affected components accordingly.