RHBA-2024:11558HighCVSS 7.5

Red Hat Bug Fix Advisory: Red Hat Quay v3.11.7 bug fix release

Published
December 19, 2024
Last Modified
August 9, 2026

🔗 CVE IDs covered (2)

CVE-2024-39338 →CVE-2024-45296 →

📋 Description

CVE-2024-39338 — axios: axios: Server-Side Request Forgery CVE-2024-45296 — path-to-regexp: Backtracking regular expressions cause ReDoS

🎯 Affected products31

  • Quay v3
  • quay/clair-rhel8@sha256:66139bdbc262578cf675edddd44cc0fc2e36baaf2e2906ceecbf3f1a13d1012c_amd64 as a component of Quay v3
  • quay/clair-rhel8@sha256:a130a4937dba6583dcdeb534d14a3c9a6de7762faedee05ad32892dffb165797_s390x as a component of Quay v3
  • quay/clair-rhel8@sha256:e4f7d5286b002b64b073ad7b04b53dffde3ea39da126c994f9926385715ebded_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:105dde55ec9222b799b679c9fcba4caa750eb672d289b4fc1249c8c14a16dffb_amd64 as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:7a68dc0b84b45626029c6f7353c86311151ddd36a608ed7f1f4e24deeabc4bfc_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-bundle@sha256:8557057c37a5aa7d6ccad682f5a0120109f5593a0dda4318d9377d2f362a1fa2_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:4004a21c7afd47c8cb089d235d1b64ebb18340bc2dece8621d21850aebda5fa2_ppc64le as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:45406d0e56b20253743e030dcd0a69306984ee62d41aeabc4a1a2b9d9438bba9_s390x as a component of Quay v3
  • quay/quay-bridge-operator-rhel8@sha256:715b80073be5641b04db2bd4eb51cd01dcb1bc2212a62586084ed79168db6604_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:480e0214246d27d6d5cbb8e535c9ca7c038bf9de26693753638191b05a137832_amd64 as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:6c52cef2a96b15cee6a449d019a86c77b4c1357bb09db1e74942f0fb85a49e0e_ppc64le as a component of Quay v3
  • quay/quay-builder-qemu-rhcos-rhel8@sha256:f52f0ca57b3a3e360b1a7a5d9fa4b9811761c0b8ea5d7454839427cbb4882bbf_s390x as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:249b3846a51e2ac165ef5f8d43d301c8765a6512f75d6313164fdd383e6cdb2f_ppc64le as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:3945e13949027f4d1de5eeb5b242025c242c1439a236fc2d3572f42bee655b59_amd64 as a component of Quay v3
  • quay/quay-builder-rhel8@sha256:61d0585c355aa676b63ede2c706f97e9df693ec3448de3c0865bf526ca8dd31e_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:2f180784b6df9fe3cbde36fd926f46fcc773dfbd4322cf820a3ac6b91b2e6af7_s390x as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:67498509413acf843d63ee660569ebc4d7e53512fb12f70c20d7deb977a0d536_amd64 as a component of Quay v3
  • quay/quay-container-security-operator-bundle@sha256:e4e9a983f2ee35763edbceb316f28938fac3c68ab098b355a8800437eabe34c6_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:796b0bb442f61b061e8b28a7daea3648a3d5bf9f3a330878afd65243b25cd22a_s390x as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:7f5b77a3d269cfb92d0345283629f60c6628d9072c0f0ed0aca132af1f377f4e_ppc64le as a component of Quay v3
  • quay/quay-container-security-operator-rhel8@sha256:c351395f10ebabd09696771c44f39237b021d863dad1f9d7bf6a3425b839451c_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:405ef346f80275091987fe2d400da176feb5a267ee534b7f21bc15799c0ddcb2_s390x as a component of Quay v3
  • quay/quay-operator-bundle@sha256:a2181f2a732c445f3662988e3dab7e9fbfa23287ea518c239cfe84b061a7b5a2_amd64 as a component of Quay v3
  • quay/quay-operator-bundle@sha256:bd9008e3b3c1acebab3f33e9859f1846608bd5143b97cf6c9f03e0846177c2dd_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:a61e50ad55e510d95fe21c37f814c7280974a9555d3e5069ae098fbfe39cb88b_amd64 as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:aff81ef3e27a1c9c6d18575743cf9fb28aa7751ca760e147569043a135c84b86_ppc64le as a component of Quay v3
  • quay/quay-operator-rhel8@sha256:e6efb3245a694364d06c40fc498eb24ed0e18fa0be04f65ca261c3a5062d19d2_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:a2f28002567710e84804664b7748bfafa72fe8d727b4235663076b19548264e5_s390x as a component of Quay v3
  • quay/quay-rhel8@sha256:b8ef9c518b24a321b57195c72d2a9292b99679f3b21dec0a527a311dde524d9a_ppc64le as a component of Quay v3
  • +1 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (2)