Red Hat Security AdvisoryRHSA-2024:0719
Migration Toolkit for Runtimes security, bug fix and enhancement update
Released 2024-02-07 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Migration Toolkit for Runtimes 1 on RHEL 8 mtr/mtr-rhel8-operator, mtr/mtr-web-container-rhel8, mtr/mtr-web-executor-container-rhel8
Fixes 2 records
Priority HIGH 72
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02761 · Published 2023-06-21 · Partial fix · 7.5.2, 6.3.1 +1 CWE-1333
Priority LOW 22
jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies.
CVSS 3.1MEDIUM 4.7· Local · Low privileges · No interaction · EPSS 0.00352 · Published 2023-06-14 · Partial fix CWE-770
