Threats Tagged 'cve-2024-43799'

Red Hat OpenShift Data Foundation 4.15 security, enhancement & bug fix update.

Red Hat OpenShift Data Foundation 4.16 security, enhancement & bug fix update.

The Migration Toolkit for Containers (MTC) enables you to migrate Kubernetes resources, persistent volume data, and internal container images between OpenShift Container Platform clusters, using the MTC web console or the Kubernetes API. Security Fix(es) from Bugzilla: * golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338) * golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868) * golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204) * http-proxy-middleware: Denial of Service (CVE-2024-21536) * cross-spawn: regular expression denial of service (CVE-2024-21538) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. This new container image is based on Red Hat Ceph Storage 7.1 and Red Hat Enterprise Linux 9.5, 9.4, 8.10. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Ceph Storage Release Notes for information on the most significant of these changes: https://docs.redhat.com/en/documentation/red_hat_ceph_storage/7/html/7.1_release_notes All users of Red Hat Ceph Storage are advised to pull these new images from the Red Hat Ecosystem catalog, which provides numerous enhancements and bug fixes.

This release of RHACS fixes the following bugs: * Fixed an issue where Central could perform image scans even when delegated scanning was enabled, due to a race condition during Sensor reconnection. * Fixed an issue where mismatched aggregation fields in Compliance tables and widgets caused inconsistent percentage displays. * Fixed an issue where you ran into Google Kubernetes Engine (GKE) compatibility test failures because the tests still used a deprecated service in RHACS 4.6. * Fixed an issue where you could see the Configuration Management page despite only having Alert permissions, resulting in role-based access control (RBAC) errors. * Fixed an issue where verifying multi-signed images failed due to incorrect error handling. This release of RHACS fixes the following security vulnerabilities: CVE-2024-21536: Flaw in http-proxy-middleware allowed denial of service through unhandled promise rejections in micromatch. CVE-2025-30204: Flaw in jwt-go allowed excessive memory allocation during header parsing, which could lead to a possible denial of service. CVE-2024-57083: Flaw in redoc allowed prototypes in mergeObjects to be tainted, which allowed a denial of service through crafted payloads.

Release of RHOAI 2.17.0 provides these changes:

HawtIO 4.1.0 for Red Hat build of Apache Camel 4 GA Release is now available. The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products. * serve-static: Improper Sanitization in serve-static (CVE-2024-43800) * send: Code Execution Vulnerability in Send Library (CVE-2024-43799) * org.springframework/spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource (CVE-2024-38816) * org.eclipse.jetty/jetty-server: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks (CVE-2024-8184) * quarkus-core: Leak of local configuration properties into Quarkus applications (CVE-2024-2700) * braces: fails to limit the number of characters it can handle (CVE-2024-4068) * undertow: Improper State Management in Proxy Protocol parsing causes information leakage (CVE-2024-7885) * path-to-regexp: Backtracking regular expressions cause ReDoS (CVE-2024-45296) * express: Improper Input Handling in Express Redirects (CVE-2024-43796)

Errata Advisory for Red Hat OpenShift GitOps v1.12.6. Security Fix(es): * openshift-gitops-argocd-container: openshift-gitops-argocd-container: Denial of Service Vulnerability in body-parser [gitops-1.12](CVE-2024-45590) * openshift-gitops-console-plugin-container: follow-redirects: Possible credential leak [gitops-1.12](CVE-2024-28849) * openshift-gitops-dex-container: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [gitops-1.12](CVE-2024-24786) * openshift-gitops-argocd-container: go-retryablehttp: url might write sensitive information to log file [gitops-1.12](CVE-2024-6104) * openshift-gitops-argocd-container: Improper Sanitization in serve-static [gitops-1.12](CVE-2024-43800) * openshift-gitops-argocd-container: Improper Input Handling in Express Redirects [gitops-1.12](CVE-2024-43796) * openshift-gitops-argocd-container: Code Execution Vulnerability in Send Library [gitops-1.12](CVE-2024-43799) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Data Foundation. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. In addition to persistent storage, Red Hat OpenShift Data Foundation provisions a multi-cloud data management service with an S3 compatible API. Bug fixes: * Previously, on the disaster recover (DR) monitoring dashboard, the detail about `Last snapshot synced` was missing for appset based applications. With this fix, the dashboard shows the `lastGroupSyncTime` under the `Volume snapshot` for the selected appset based applications. (BZ#2295324) * Previously, when OpenShift Data Foundation was installed in a namespace other than `openshift-storage`, such as ROSA, the user interface (UI) labelled the nodes during the StorageSystem deployment and added a dynamic label "cluster.ocs.openshift.io/<CLUSTER_NAMESPACE>: ‘'", where "CLUSTER_NAMESPACE" is the namespace in which the StorageSystem is getting created). However the ODF/OCS operators expected the label to be always a static label, "cluster.ocs.openshift.io/openshift-storage: ‘’. With this fix, the user interface adds a static label "cluster.ocs.openshift.io/openshift-storage: ‘’ to the nodes and as a result the installation proceeds as expected. (BZ#2303083) Enhancement: * In the storage clients table of the Storage clients page of the OpenShift web console, storage cluster name is displayed along with the cluster ID to provide better clarity. (BZ#2304905) All users of Red Hat OpenShift Data Foundation are advised to upgrade to these updated images, which provide these bug fixes.

This release includes security, bug fixes, and enhancements. Security Fix(es): * axios: axios: Server-Side Request Forgery (CVE-2024-39338) * express: Improper Input Handling in Express Redirects (CVE-2024-43796) * io.vertx/vertx-grpc-client: Vertx gRPC server does not limit the maximum message size (CVE-2024-8391) * io.vertx/vertx-grpc-server: Vertx gRPC server does not limit the maximum message size (CVE-2024-8391) * send: Code Execution Vulnerability in Send Library (CVE-2024-43799) * serve-static: Improper Sanitization in serve-static (CVE-2024-43800) * webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule (CVE-2024-43788) For more details about the security issues, including the impact, a CVSS score, acknowledgements, and other related information, refer to the CVE pages listed in the References section.