Red Hat Security Advisory

RHSA-2024:10857

Multicluster Engine for Kubernetes 2.7.2 security updates and bug fixes

Released 2024-12-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8
multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-image-service-rhel9, multicluster-engine/assisted-installer-agent-rhel9 +31

Fixes 3 records

TI-2023-25448 CVE-2023-47108 · GHSA-8pgv-569h-w5rw

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

HIGH 72

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02026 Published 2023-11-10 Partial fix · 0.46.0 CWE-770

TI-2024-30367 CVE-2024-45296 · GHSA-9wv6-86v2-598j

path-to-regexp outputs backtracking regular expressions

MEDIUM 41

path-to-regexp turns path strings into a regular expressions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00932 Published 2024-09-09 Partial fix · 0.1.10, 8.0.0 +3 CWE-1333

TI-2024-30779 CVE-2024-45813 · GHSA-rrr8-f88r-h8q6

ReDoS vulnerability in multiparametric routes in find-my-way

LOW 25

find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00681 Published 2024-09-18 Partial fix · 8.2.2, 9.0.1 CWE-1333