Red Hat Security AdvisoryRHSA-2025:0778
Multicluster Engine for Kubernetes 2.6.5 security updates and bug fixes
Released 2025-01-28 · Red Hat rating Important · View on Red Hat →
Fixed in
- multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-controller-rhel8 +2
- multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/backplane-rhel9-operator +27
Fixes 3 records
Priority MEDIUM 53
Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.03181 · Published 2024-12-11 · Partial fix · 0.31.0 CWE-285
Priority LOW 32
An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01072 · Published 2024-12-18 · Partial fix · 0.33.0 CWE-1333
Priority LOW 21
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00665 · Published 2024-12-09 · Partial fix · 5.0.9, 3.3.8 CWE-835
