RHSA-2024:10906HighCVSS 7.5

Red Hat Security Advisory: Migration Toolkit for Containers (MTC) 1.8.5 security and bug fix update

Published
December 10, 2024
Last Modified
August 24, 2026

🔗 CVE IDs covered (11)

CVE-2024-24790 →CVE-2024-24791 →CVE-2024-34158 →CVE-2024-43788 →CVE-2024-43796 →CVE-2024-43799 →CVE-2024-43800 →CVE-2024-34155 →CVE-2024-34156 →CVE-2024-45296 →CVE-2024-45590 →

📋 Description

CVE-2024-24790 — golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-24791 — net/http: Denial of service due to improper 100-continue handling in net/http CVE-2024-34155 — go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion CVE-2024-34156 — encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion CVE-2024-34158 — go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion CVE-2024-43788 — webpack: DOM Clobbering vulnerability in AutoPublicPathRuntimeModule CVE-2024-43796 — express: Improper Input Handling in Express Redirects CVE-2024-43799 — send: Code Execution Vulnerability in Send Library CVE-2024-43800 — serve-static: Improper Sanitization in serve-static CVE-2024-45296 — path-to-regexp: Backtracking regular expressions cause ReDoS CVE-2024-45590 — body-parser: Denial of Service Vulnerability in body-parser

🎯 Affected products12

  • 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-controller-rhel8@sha256:4657efd532ccf0e4d945e2d212d1022877a6da0d33dead66811c097d01842319_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-hook-runner-rhel8@sha256:567c14ac62514b8e60d2a8aaf49bd4666e0612f17ec3077a35849013cefbf8dc_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-log-reader-rhel8@sha256:4d78ea33f02d7b0de64b16c0dd58c67fbfafac3783948250eb5361c2b0d1fbed_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-must-gather-rhel8@sha256:252375b7e90707ee71d68b38ec5dcbe16c61188fecc723bcf7dd72944b80a6eb_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-openvpn-rhel8@sha256:eab006db0ded34f36609011fab5bf1f02825149d74347837cd28dd9ed3cbcccf_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-operator-bundle@sha256:1ee51dfcf4fba81d24fed333657b241eec98d961e3e5d1549ba9d902237c5ecb_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-registry-rhel8@sha256:91a75a438ae32c7e0826c3d5aab25f2597812331b8911b040da7cb9a31a25007_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-rhel8-operator@sha256:91ec7e1765d4ee8a808e1eede50c610c37deb3e78c9932f76b5c222d9a978e4c_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-rsync-transfer-rhel8@sha256:6e8e1c6c3db9ddf500d07e5f2453473e7dfe0bf0195aaa0ef11ed4c86ea58c31_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-ui-rhel8@sha256:ae3dc96aa16f80c2386daf976d0fc5a4b3501aa923342728a9d8020571adef47_amd64 as a component of 8Base-RHMTC-1.8
  • rhmtc/openshift-migration-velero-plugin-for-mtc-rhel8@sha256:777e10015629b4295ffd279e8e97945a25f3eae9619ce82f0238a277a529849b_amd64 as a component of 8Base-RHMTC-1.8

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (15)