Red Hat Security Advisory

RHSA-2024:11381

Red Hat Advanced Cluster Management 2.11.4 security enhancements and bug fixes

Released 2024-12-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9 +40

Fixes 3 records

TI-2024-30367 CVE-2024-45296 · GHSA-9wv6-86v2-598j

path-to-regexp outputs backtracking regular expressions

MEDIUM 41

path-to-regexp turns path strings into a regular expressions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00932 Published 2024-09-09 Partial fix · 0.1.10, 8.0.0 +3 CWE-1333

TI-2024-30768 CVE-2024-45801 · GHSA-mmhx-hmjr-r674

Tampering by prototype polution in DOMPurify

LOW 34

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00894 Published 2024-09-16 Partial fix · 2.5.4, 3.1.3 CWE-1333

TI-2024-30779 CVE-2024-45813 · GHSA-rrr8-f88r-h8q6

ReDoS vulnerability in multiparametric routes in find-my-way

LOW 25

find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00681 Published 2024-09-18 Partial fix · 8.2.2, 9.0.1 CWE-1333