rhsa-2025_2415
Vulnerability from csaf_redhat
Published
2025-03-05 20:41
Modified
2025-03-25 11:12
Summary
Red Hat Security Advisory: Red Hat Insights for Runtimes security update
Notes
Topic
An update is now available for Red Hat Insights for Runtimes on RHEL 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
An update is now available for the Red Hat Insights for Runtimes on RHEL 8.
Security Fix(es):
* golang: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat Insights for Runtimes on RHEL 8.\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "An update is now available for the Red Hat Insights for Runtimes on RHEL 8.\nSecurity Fix(es):\n* golang: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2025:2415",
"url": "https://access.redhat.com/errata/RHSA-2025:2415"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-45338",
"url": "https://access.redhat.com/security/cve/CVE-2024-45338"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_2415.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Insights for Runtimes security update",
"tracking": {
"current_release_date": "2025-03-25T11:12:17+00:00",
"generator": {
"date": "2025-03-25T11:12:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.4.1"
}
},
"id": "RHSA-2025:2415",
"initial_release_date": "2025-03-05T20:41:26+00:00",
"revision_history": [
{
"date": "2025-03-05T20:41:26+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2025-03-24T20:41:26+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-03-25T11:12:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Insights for Runtimes 1.0",
"product": {
"name": "Red Hat Insights for Runtimes 1.0",
"product_id": "Red Hat Insights for Runtimes 1.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:insights_runtimes_operator:1.0::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Insights for Runtimes"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:a7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489_amd64",
"product": {
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:a7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489_amd64",
"product_id": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:a7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489_amd64",
"product_identification_helper": {
"purl": "pkg:oci/runtimes-inventory-rhel8-operator@sha256%3Aa7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489?arch=amd64\u0026repository_url=registry.redhat.io/insights-runtimes-tech-preview"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae_arm64",
"product": {
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae_arm64",
"product_id": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae_arm64",
"product_identification_helper": {
"purl": "pkg:oci/runtimes-inventory-rhel8-operator@sha256%3A004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae?arch=arm64\u0026repository_url=registry.redhat.io/insights-runtimes-tech-preview"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7_ppc64le",
"product": {
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7_ppc64le",
"product_id": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/runtimes-inventory-rhel8-operator@sha256%3Af52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7?arch=ppc64le\u0026repository_url=registry.redhat.io/insights-runtimes-tech-preview"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2_s390x",
"product": {
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2_s390x",
"product_id": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/runtimes-inventory-rhel8-operator@sha256%3Af26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2?arch=s390x\u0026repository_url=registry.redhat.io/insights-runtimes-tech-preview"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae_arm64 as a component of Red Hat Insights for Runtimes 1.0",
"product_id": "Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae_arm64"
},
"product_reference": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae_arm64",
"relates_to_product_reference": "Red Hat Insights for Runtimes 1.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:a7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489_amd64 as a component of Red Hat Insights for Runtimes 1.0",
"product_id": "Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:a7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489_amd64"
},
"product_reference": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:a7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489_amd64",
"relates_to_product_reference": "Red Hat Insights for Runtimes 1.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2_s390x as a component of Red Hat Insights for Runtimes 1.0",
"product_id": "Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2_s390x"
},
"product_reference": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2_s390x",
"relates_to_product_reference": "Red Hat Insights for Runtimes 1.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7_ppc64le as a component of Red Hat Insights for Runtimes 1.0",
"product_id": "Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7_ppc64le"
},
"product_reference": "registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7_ppc64le",
"relates_to_product_reference": "Red Hat Insights for Runtimes 1.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-45338",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2024-12-18T21:00:59.938173+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2333122"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. This flaw allows an attacker to craft input to the parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This issue can cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an attacker can craft malicious input that causes the parsing functions to process data non-linearly, resulting in significant delays which leads to a denial of service by exhausting system resources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae_arm64",
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:a7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489_amd64",
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2_s390x",
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-45338"
},
{
"category": "external",
"summary": "RHBZ#2333122",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2333122"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-45338",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45338"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-45338",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45338"
},
{
"category": "external",
"summary": "https://go.dev/cl/637536",
"url": "https://go.dev/cl/637536"
},
{
"category": "external",
"summary": "https://go.dev/issue/70906",
"url": "https://go.dev/issue/70906"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ",
"url": "https://groups.google.com/g/golang-announce/c/wSCRmFnNmPA/m/Lvcd0mRMAwAJ"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2024-3333",
"url": "https://pkg.go.dev/vuln/GO-2024-3333"
}
],
"release_date": "2024-12-18T20:38:22.660000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-03-05T20:41:26+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae_arm64",
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:a7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489_amd64",
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2_s390x",
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2025:2415"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:004c6cfbb4a91e8d62b94e831be380cb217a7a20438dfbe4a3503352b74c6aae_arm64",
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:a7f94c4a1b5b513c76273678840f512358d4ac51281beacc36d1ea23b299f489_amd64",
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f26625be2d9b92d68d7633c92b601222a162c6ab76116a58ef57fe3db896eaa2_s390x",
"Red Hat Insights for Runtimes 1.0:registry.redhat.io/insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator@sha256:f52de3cbca1eb2e4e42d6b107a7efd57958757a9a2015cb13bf54632a4f727a7_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html"
}
]
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.