Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an OpenShift Container Platform installation.
Security Fix(es):
* send: Code Execution Vulnerability in Send Library (CVE-2024-43799)
* serve-static: Improper Sanitization in serve-static (CVE-2024-43800)
* express: Improper Input Handling in Express Redirects (CVE-2024-43796)
* path-to-regexp: Backtracking regular expressions cause ReDoS (CVE-2024-45296)
* webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule
(CVE-2024-43788)
* body-parser: Denial of Service Vulnerability in body-parser (CVE-2024-45590)
* envoy: Malicious log injection via access logs (CVE-2024-45808)
* envoy: Potential to manipulate `x-envoy` headers from external sources (CVE-2024-45806)
* envoy: Envoy crashes for `LocalReply` in HTTP async client (CVE-2024-45810)
* curl: libcurl: ASN.1 date parser overread (CVE-2024-7264)
* envoy: Potential to manipulate `x-envoy` headers from external sources (CVE-2024-45806)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.