RHSA-2025:0386HighCVSS 8.2

Red Hat Security Advisory: VolSync 0.10.2 for RHEL 9

Published
January 16, 2025
Last Modified
September 7, 2026

🔗 CVE IDs covered (3)

CVE-2024-45337 →CVE-2024-45338 →CVE-2024-53259 →

📋 Description

CVE-2024-45337 — golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto CVE-2024-45338 — golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html CVE-2024-53259 — quic-go: quic-go affected by an ICMP Packet Too Large Injection Attack on Linux

🎯 Affected products6

  • Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
  • rhacm2/volsync-operator-bundle@sha256:1cec6197368b7d5a9712b89786d2b17185081a53ade8a693557da580686007bc_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
  • rhacm2/volsync-rhel9@sha256:1cb132539aa8a0ecb5bf395db48306adcb0ec66deec5c257f54c223b721a65bc_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
  • rhacm2/volsync-rhel9@sha256:6a041d90d24a4463ee7bc08148ec8c1e811c1b02d9028d66e54ba8be479ae13b_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
  • rhacm2/volsync-rhel9@sha256:86e1cc2f2abbcf13e1a104b1d985c8d7685a6c66fb6f2770bb38da165a597848_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9
  • rhacm2/volsync-rhel9@sha256:c619a9bde6e0afce2dde87fcbc27148dc9ccf83f522662499e0031315a731ce3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9

✅ Remediation

For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation: https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/business_continuity/business-cont-overview#volsync Workaround: Use iptables to drop ICMP unreachable packets.

🔗 References (7)