RHSA-2024:3316HighCVSS 7.5

Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update

Published
May 23, 2024
Last Modified
August 25, 2026

🔗 CVE IDs covered (11)

CVE-2023-48631 →CVE-2024-24786 →CVE-2024-28849 →CVE-2024-29180 →CVE-2023-39326 →CVE-2023-45286 →CVE-2023-45287 →CVE-2023-45857 →CVE-2023-26159 →CVE-2023-26364 →CVE-2023-45288 →

📋 Description

CVE-2023-26159 — follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() CVE-2023-26364 — css-tools: Improper Input Validation causes Denial of Service via Regular Expression CVE-2023-39326 — golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests CVE-2023-45286 — go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2 CVE-2023-45287 — golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. CVE-2023-45288 — golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS CVE-2023-45857 — axios: exposure of confidential data stored in cookies CVE-2023-48631 — css-tools: regular expression denial of service (ReDoS) when parsing CSS CVE-2024-24786 — golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON CVE-2024-28849 — follow-redirects: Possible credential leak CVE-2024-29180 — webpack-dev-middleware: lack of URL validation may lead to file leak

🎯 Affected products13

  • MTA 7.0 for RHEL 8
  • MTA 7.0 for RHEL 9
  • mta/mta-analyzer-addon-rhel9@sha256:0c0381b7e457651468411ac42db0cd87070bc711321b51db4d73da7443d9873b_amd64 as a component of MTA 7.0 for RHEL 9
  • mta/mta-analyzer-lsp-rhel9@sha256:a09bcb0103144127baaea5831a75313a5148c1cacca2ca52fdfd93b09986d1fc_arm64 as a component of MTA 7.0 for RHEL 9
  • mta/mta-analyzer-lsp-rhel9@sha256:eeb59395e040f7b5367b5c0e4911e5ee23289cf13a42c517dfe30ec385ddeede_amd64 as a component of MTA 7.0 for RHEL 9
  • mta/mta-cli-rhel9@sha256:1f68cef1b46537edbb48d0842761258c8e8f9456cf2e5f93317e17307646c51d_amd64 as a component of MTA 7.0 for RHEL 9
  • mta/mta-cli-rhel9@sha256:7f9db3bb4df9fa6680c58547974f2c5f1035ba9e65f51acdaea12c082fc78c99_arm64 as a component of MTA 7.0 for RHEL 9
  • mta/mta-hub-rhel9@sha256:9e8489a7a70be8a4035de9921bd7360dd993dfc364fca97abcd7ef5f637bae07_amd64 as a component of MTA 7.0 for RHEL 9
  • mta/mta-operator-bundle@sha256:9eeb43af2bcab84f5261d1575f7c897903a7696dba011d256abffa1fe850eba2_amd64 as a component of MTA 7.0 for RHEL 9
  • mta/mta-rhel8-operator@sha256:1719cafe5b15c44bb1bb207bce1cc2a6ee7c1b097901d8fab61912ce298f40dd_amd64 as a component of MTA 7.0 for RHEL 8
  • mta/mta-ui-rhel9@sha256:d0a02e3d0067cd6811e00a55b644dd9a345261e3f77ed72431a3ce03137d11bf_amd64 as a component of MTA 7.0 for RHEL 9
  • mta/mta-windup-shim-rhel9@sha256:0ee12e416243c3d96ff86d96d203925259f2408633b28db485ff7a0378b7b092_arm64 as a component of MTA 7.0 for RHEL 9
  • mta/mta-windup-shim-rhel9@sha256:122ddc6b9f403fe1dddcd25ee4376cbfb33264019e3199418d879634500389dc_amd64 as a component of MTA 7.0 for RHEL 9

✅ Remediation

For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is yet available for this vulnerability. Workaround: No mitigation is available for this flaw. Workaround: No current mitigation is available for this vulnerability. Workaround: In some environments where http/2 support is not required, it may be possible to disable this feature to reduce risk. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (51)