Read the docs
Red Hat Security Advisory

RHSA-2024:9583

ACS 4.4 enhancement update

Released 2024-11-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 5 records

TI-2024-16306 CVE-2024-24789 · GHSA-236w-p7wf-5ph8

Mishandling of corrupt central directory record in archive/zip

Priority MEDIUM 58

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00443 Published 2024-06-05 Partial fix · 1.21.11, 1.22.4
TI-2024-16307 CVE-2024-24790 · GHSA-49gw-vxvf-fc2g

Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

Priority MEDIUM 53

The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01952 Published 2024-06-05 Partial fix · 1.21.11, 1.22.4
TI-2024-32607 CVE-2024-48910 · GHSA-p3vf-v8qc-cwcr

DOMPurify vulnerable to tampering by prototype polution

Priority MEDIUM 51

DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01151 Published 2024-10-31 Partial fix · 2.4.2 CWE-1321
TI-2024-22606 CVE-2024-34156 · GHSA-crqm-pwhx-j97f

Stack exhaustion in Decoder.Decode in encoding/gob

Priority MEDIUM 41

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01127 Published 2024-09-06 Partial fix · 1.22.7, 1.23.1