Threats Tagged 'cve-2024-32475'

Red Hat OpenShift Service Mesh 2. 5. 5 addresses multiple security vulnerabilities across several components including Envoy, Send library, serve-static, webpack, and body-parser. These vulnerabilities range from code execution, denial of service, improper sanitization, to potential header manipulation. The advisory covers nine CVEs, including CVE-2024-23326 where Envoy incorrectly accepts HTTP 200 responses for entering upgrade mode, and others affecting HTTP/2 CPU exhaustion, infinite loops, and abnormal termination. The update is classified with high severity and is intended for Red Hat OpenShift Service Mesh on various architectures. Users are advised to apply the update after ensuring all previous errata are applied.

Red Hat OpenShift Service Mesh Containers for version 2. 4. 11 address multiple security vulnerabilities affecting components such as envoy, webpack, send library, and serve-static. These include an abnormal termination issue in envoy triggered by an authority header longer than 255 characters (CVE-2024-32475), an infinite loop in the Brotli decompressor (CVE-2024-32976), a DOM Clobbering vulnerability in webpack (CVE-2024-43788), a code execution vulnerability in the send library (CVE-2024-43799), and improper sanitization in serve-static (CVE-2024-43800). Red Hat has released an advisory (RHSA-2024:7724) detailing these fixes and recommends applying the update after ensuring all prior errata are installed.