RHSA-2024:0719MediumCVSS 7.5

Red Hat Security Advisory: Migration Toolkit for Runtimes security, bug fix and enhancement update

Published
February 7, 2024
Last Modified
August 4, 2026

🔗 CVE IDs covered (2)

CVE-2022-25883 →CVE-2023-35116 →

📋 Description

CVE-2022-25883 — nodejs-semver: Regular expression denial of service CVE-2023-35116 — jackson-databind: denial of service via cylic dependencies

🎯 Affected products16

  • Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-operator-bundle@sha256:8723ff82aa53d56530e923340289f549f9cae9d1d66ae6559d07db9535c53c4b_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-operator-bundle@sha256:8c91c79d241c860d9dbf64ad02ce319dd4b4787f7f2c8a14d2d685624806ed04_arm64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-operator-bundle@sha256:9046593959cf11bc952f5bda39478fd5abc3e7ab5c61a4fdf96d15897aa0d78f_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-operator-bundle@sha256:b786a18de43145dbe1ec6a137bf6dbe72adca095146c7158424eda0ad84abd82_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-rhel8-operator@sha256:61cdc15df15d08b2d133bc4f8fe31bffbee209de1faf9ccc5cf1285c2a6aca1c_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-rhel8-operator@sha256:8e4b3b5bb06df89b119bb93234aec29660ff03481298074c2f011f74d4c185f0_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-rhel8-operator@sha256:c8b896612d3682641298ddd7502cda0ef6425c53b724aa3bfd4a31352c960087_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-rhel8-operator@sha256:ef4ecb153b4b8b14d63f7d331ffe158b180120e20ce94599e6a7cfa74fa49b6a_arm64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-web-container-rhel8@sha256:34e91adfb0c4a0ce3be35cefd7c6c585fa866a150629c06c06555c34933f7cbc_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-web-container-rhel8@sha256:a314c3e344566e9772b609e5aacffcc78fee8f7d56002f6d9d97d7cba572d6ae_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-web-container-rhel8@sha256:a864b9445262878cb0066ae7101c1a1998ce335bb72ce013ac561d19a021eb22_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-web-executor-container-rhel8@sha256:91164350574d037eea7f4a456213977fbd34bf78a150e1efa9f58360295e97e4_s390x as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-web-executor-container-rhel8@sha256:c58c38ea26dfa2d07d73bdc403c7645574ddc9ee17304fcc5d61ff876dcf6097_arm64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-web-executor-container-rhel8@sha256:cd600c6d2f9b7c5f1863586c39f66951d37b0e6098f455c3f65cc9a783d05158_ppc64le as a component of Migration Toolkit for Runtimes 1 on RHEL 8
  • mtr/mtr-web-executor-container-rhel8@sha256:d79c7de19d3b751331fc64d53f1ebe27b71ab3a92dda65fa44ddf0e9e7e24bbd_amd64 as a component of Migration Toolkit for Runtimes 1 on RHEL 8

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: jackson-databind should not be used to deserialize untrusted inputs. User inputs should be validated and sanitized before processing.

🔗 References (5)