Threats Tagged 'cve-2024-45296'

Red Hat has released HawtIO 4. 1. 0 for the Red Hat build of Apache Camel 4, addressing multiple security vulnerabilities across various components. These include improper sanitization, code execution, path traversal, denial of service, information leakage, and regular expression denial of service (ReDoS) issues. The update aims to improve developer experience while ensuring security and stability. The advisory rates the security impact as Important (high severity). No CVSS scores are provided, but the vulnerabilities affect critical libraries and frameworks used in enterprise applications.

This release of RHACS 4.5.5 introduces the following changes: Bug fix: * Fixed an issue with redirects in curl commands leading to empty files and errors in scanning. (ROX-26929) * Scanner V4 now reindexes image upon indexer updates. (ROX-23956) Security fixes: * encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156) * body-parser: Denial of Service Vulnerability in body-parser (CVE-2024-45590) * dompurify: DOMPurify vulnerable to tampering by prototype pollution (CVE-2024-48910) * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789) * golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790) * cross-spawn: Regular expression denial of service (CVE-2024-21538) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Logging for Red Hat OpenShift - 5.9.4 logging-loki-container: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

The Kube Descheduler Operator for Red Hat OpenShift is an optional operator that deploys the descheduler, which is responsible for evicting pods based on certain strategies. Security Fix(es): * Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155) * Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158) * encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)