RHSA-2024:1027MediumCVSS 8.2

Red Hat Security Advisory: Migration Toolkit for Applications security update

Published
February 28, 2024
Last Modified
August 11, 2026

🔗 CVE IDs covered (9)

CVE-2023-35116 →CVE-2022-45693 →CVE-2023-2976 →CVE-2022-1962 →CVE-2022-46751 →CVE-2023-1436 →CVE-2023-26159 →CVE-2023-29406 →CVE-2023-29409 →

📋 Description

CVE-2022-1962 — golang: go/parser: stack exhaustion in all Parse* functions CVE-2022-45693 — jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos CVE-2022-46751 — apache-ivy: XML External Entity vulnerability CVE-2023-1436 — jettison: Uncontrolled Recursion in JSONArray CVE-2023-2976 — guava: insecure temporary directory creation CVE-2023-26159 — follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() CVE-2023-29406 — golang: net/http: insufficient sanitization of Host header CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-35116 — jackson-databind: denial of service via cylic dependencies

🎯 Affected products7

  • MTA 6.2 for RHEL 8
  • mta/mta-hub-rhel9@sha256:b232b42b2de4be2d7c67ef2418070b155b79a275e2cbba343a04c22c1e016662_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-operator-bundle@sha256:d142049160f51b71f1c9d970e23824952ca35e7c2e23d6c8753a33e727b87b81_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-pathfinder-rhel9@sha256:781aef6a3a23c765a31e38a36ebc4c40957249888532f46a77d320f416816508_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-rhel8-operator@sha256:e1e6f80467054b95379c1b482800a656917e1cfd35d8fac2d4f6ff4091088a67_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-ui-rhel9@sha256:2e10de6bd9bb24a03579f555b71e6ff57f2c9d74cf3b79ec42e9dba4cab628a1_amd64 as a component of MTA 6.2 for RHEL 8
  • mta/mta-windup-addon-rhel9@sha256:73671e9d3c4bf624d1a6745c5002b93b158519abf6b13c7bb0e1491d873316fc_amd64 as a component of MTA 6.2 for RHEL 8

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Temp files should be created with sufficiently non-predictable names and in a secure-permissioned, dedicated temp folder. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: jackson-databind should not be used to deserialize untrusted inputs. User inputs should be validated and sanitized before processing.

🔗 References (13)