RHSA-2024:2944

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.

Not all valid JavaScript whitespace characters are considered to be whitespace.

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients.

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.

A denial of service is possible from excessive resource consumption in net/http and mime/multipart.

Large handshake records may cause panics in crypto/tls.

In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.

Reader.Read does not set a limit on the maximum size of file headers.

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts.

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http.

The x/crypto/ssh package before 0.0.0-20211202192323-5770296d904e of golang.org/x/crypto allows an attacker to panic an SSH server.

Templates containing actions in unquoted HTML attributes (e.g.

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.