RHSA-2025:0385HighCVSS 8.2

Red Hat Security Advisory: VolSync 0.11.1 for RHEL 9

Published
January 16, 2025
Last Modified
September 6, 2026

🔗 CVE IDs covered (3)

CVE-2024-45337 →CVE-2024-45338 →CVE-2024-53259 →

📋 Description

CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2024-53259 — quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

🎯 Affected products6

  • Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/volsync-operator-bundle@sha256:b1eb7e31f2a3e3371231223e01f4d06b609340b2403b53491c7a19c6d482609a_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/volsync-rhel9@sha256:5b093fc18988671085c78478167fb45b7d2fca1a0ae56860dae6dfe05ea61ee7_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/volsync-rhel9@sha256:65c8d7313d6dd1d6a61cbba457639bbce9e5f3adea53c6c17ad939d72a875d34_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/volsync-rhel9@sha256:67d36bc0e9fa06e9a9fa039d06c895e67813a4e6be9c034410766296196870e0_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9
  • rhacm2/volsync-rhel9@sha256:9a882ab03dedd84c31280b22811e4642989cc6a96820a3a003f091a50462dfa0_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/business_continuity/business-cont-overview#volsync Workaround: Use iptables to drop ICMP unreachable packets.

🔗 References (7)