Red Hat Security AdvisoryRHSA-2025:23529
Red Hat Advanced Cluster Management for Kubernetes 2.11.9 security update
Released 2025-12-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/console-rhel9, registry.redhat.io/rhacm2/klusterlet-addon-controller-rhel9, registry.redhat.io/rhacm2/kube-rbac-proxy-rhel9 +3
Fixes 5 records
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 76
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP).
CVSS 4.0CRITICAL 9.4· Network · No auth · No interaction · EPSS 0.0181 · Published 2025-07-18 · Partial fix · 2.5.4, 3.0.4 +1 CWE-330
Priority HIGH 72
Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00738 · Published 2025-08-20 · Partial fix · 2.4.12 CWE-20
Priority HIGH 72
Improper Input Validation vulnerability in cipher-base allows Input Data Manipulation.This issue affects cipher-base: through 1.0.4.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.0055 · Published 2025-08-20 · Partial fix · 1.0.5 CWE-20
Priority LOW 28
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID.
CVSS 3.1MEDIUM 6.4· Local · High privileges · No interaction · EPSS 0.00243 · Published 2025-08-07 · Partial fix · 0.15.2, v4.17.39-2 +119 CWE-276
THREATIST.IORead the docs