Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function
n/a · n/a
7.5HighCVSS 3.1
Recommended action
Within 7 days
High technical severity; prioritise exposed affected systems while verifying vendor guidance.
Patch available
Direct vendor intelligence
Authoritative vendor CSAF and VEX advisories
Structured product status and remediation from the issuing vendor. Product-state explanations are always visible; large lists can be searched or downloaded.
1 current
CVE-2024-39249 · CSAF 2.0 · revision 3 · finalRed Hat Product Securitynodejs-async: Regular expression denial of service while parsing function in autoinject
28 known affected
The vendor explicitly identifies these products as affected by this CVE.
async.src as a component of Migration Toolkit for Applications 6
mta/mta-ui-rhel9 as a component of Migration Toolkit for Applications 6
multicluster-engine/console-mce-rhel8 as a component of Multicluster Engine for Kubernetes
network-observability/network-observability-console-plugin-rhel9 as a component of Network Observability Operator
workload-availability/node-remediation-console-rhel8 as a component of Node HealthCheck Operator
openshift-pipelines/pipelines-hub-api-rhel8 as a component of OpenShift Pipelines
openshift-pipelines/pipelines-hub-db-migration-rhel8 as a component of OpenShift Pipelines
openshift-pipelines/pipelines-hub-ui-rhel8 as a component of OpenShift Pipelines
async.src as a component of OpenShift Serverless
3scale-amp-system-container as a component of Red Hat 3scale API Management Platform 2
openresty.src as a component of Red Hat 3scale API Management Platform 2
rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes 2
Summary
A flaw was found in the async Node.js package. A Regular expression Denial of Service (ReDoS) attack can potentially be triggered via the autoinject function while parsing specially crafted input.
Remediation
If you are using an earlier version of RHACS 4.5, you are advised to upgrade to this patch release 4.5.3.
Optional official sources
National CERT insights ?CERT means Computer Emergency Response Team; CSIRT is the closely related term Computer Security Incident Response Team.
Select the national-authority views to include. The exact source language is shown on each matched advisory. Your choice is remembered on this device and encoded in the shareable URL.
Official European source
ENISA European Vulnerability Database
Official EUVD identifiers, advisory evidence and known-exploited context. Missing fields are not treated as evidence of low risk.
1 current
ENISA EUVD identifier
EUVD-2024-37879
No EUVD known-exploited evidence
ENISA has published the identifier mapping but no EUVD description has been stored yet.
EUVD state
Present in the current official mapping
Known exploitation
Not present in the current ENISA EUVD known-exploited dataset. This is not proof of no exploitation.
ENISA score
Not supplied in the stored EUVD record
Advisory evidence
No linked advisory details stored yet
Recommended actionWithin 7 days
High technical severity; prioritise exposed affected systems while verifying vendor guidance.
Patch available
01
What, why and how
Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOTE: this is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input.
What
Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOTE: this is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input.
Why
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
What
Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. NOTE: this is disputed by the supplier because there is no realistic threat model: regular expressions are not used with untrusted input.
Why
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How
An attacker operating through a network path may attempt exploitation without authentication or user interaction. If successful, the issue may disrupt the affected service.
02
Exploit reality and attack path
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
Observed exploitation ?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.No confirmed evidence
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
Public PoC / exploit material ?Confirmed exploitation and public exploit material are separate signals. Attacks can occur without public proof-of-concept or exploit code.None recorded
No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.
Likely attack path
a network path → Inefficient Regular Expression Complexity → disrupt the affected service
Attack surface
Network
Privileges required
None: unauthenticated exploitation is possible
User interaction
None
Attack complexity
Low: no specialised conditions are recorded
Security boundary
Unchanged: impact remains within the vulnerable component's security authority
Weakness ?CWE means Common Weakness Enumeration: a standard category for the underlying weakness.
CWE-1333: Inefficient Regular Expression Complexity. The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
CVSS vector ?CVSS means Common Vulnerability Scoring System. The vector records the metric values used to calculate technical severity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Common Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
AVNetworkAttack vector: The vulnerable component can be reached over a network.ACLowAttack complexity: No specialised conditions are required beyond attacker-controlled input.PRNonePrivileges required: The attacker does not need an account or existing privileges.UINoneUser interaction: No action by another user is required.SUnchangedScope: The security impact remains within the vulnerable component's authority.CNoneConfidentiality impact: No direct loss is represented by this metric.INoneIntegrity impact: No direct loss is represented by this metric.AHighAvailability impact: A successful attack can cause a major loss.
Post-exploitation / living off the land
No specific living-off-the-land technique is confirmed in the structured sources. Monitor normal administration tools for activity inconsistent with the affected service's baseline.
NetworkUnauthenticatedDenial of serviceCWE-1333
A
Official authority intelligence
Only matched European and national findings are included. Language selectors and unavailable sources are omitted.
ENISA EUVD · EUVD-2024-37879Official EUVD mapping
0 linked advisory records.
Official EUVD recordBSI · German · WID-SEC-W-2024-3330Red Hat Trusted Profile Analyzer: Schwachstelle ermöglicht Denial of Service
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Trusted Profile Analyzer ausnutzen, um einen Denial of Service Angriff durchzuführen.
Official advisoryCERT-FR · French · CERTFR-2024-AVI-0841Multiples vulnérabilités dans les produits IBM
ecord?id=CVE-2024-23651
Référence CVE CVE-2024-23652
https://www.cve.org/CVERecord?id=CVE-2024-23652
Référence CVE CVE-2024-23653
https://www.cve.org/CVERecord?id=CVE-2024-23653
Référence CVE CVE-2024-25026
https://www.cve.org/CVERecord?id=CVE-2024-25026
Référence CVE CVE-2024-27267
https://www.cve.org/CVERecord?id=CVE-2024-27267
Référence CVE CVE-2024-27280
https://www.cve.org/CVERecord?id=CVE-2024-27280
Référence CVE CVE-2024-3154
https://www.cve.org/CVERecord?id=CVE-2024-3154
Référence CVE CVE-2024-3727
https://www.cve.org/CVERecord?id=CVE-2024-3727
Référence CVE CVE-2024-37890
https://www.cve.org/CVERecord?id=CVE-2024-37890
Référence CVE CVE-2024-39249
https://www.cve.org/CVERecord?id=CVE-2024-39249
Référence CVE CVE-2024-39689
https://www.cve.org/CVERecord?id=CVE-2024-39689
Référence CVE CVE-2024-4068
https://www.cve.org/CVERecord?id=CVE-2024-4068
Référence CVE CVE-2024-41110
https://www.cve.org/CVERecord?id=CVE-2024-41110
Gestion détaillée du document
le 04 octobre 2024
Version initiale
Alertes
Avis
Bulletins d’actualités
Mentions légales
Conditions générales
À propos
Contact
cyber.gouv.fr
service-public.fr
legifrance.gouv.fr
info.gouv.fr
france.fr
info.gouv.fr/risques
Premier Ministre / Secrétariat Général de la Défense et de la Sécurité Nationale / Agence nationale de la
sécurité des s
Operational remediation based on structured source evidence.
Status ?Patch availability is based on structured fixed-version fields and authoritative update references. If no fix is verified, check the vendor advisory before making a change.
Patch available
Affected
async.src as a component of Migration Toolkit for Applications 6; mta/mta-ui-rhel9 as a component of Migration Toolkit for Applications 6; multicluster-engine/console-mce-rhel8 as a component of Multicluster Engine for Kubernetes; network-observability/network-observability-console-plugin-rhel9 as a component of Network Observability Operator; workload-availability/node-remediation-console-rhel8 as a component of Node HealthCheck Operator; openshift-pipelines/pipelines-hub-api-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-db-migration-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-ui-rhel8 as a component of OpenShift Pipelines; async.src as a component of OpenShift Serverless; 3scale-amp-system-container as a component of Red Hat 3scale API Management Platform 2; openresty.src as a component of Red Hat 3scale API Management Platform 2; rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes 2; advanced-cluster-security/rhacs-central-db-rhel8 as a component of Red Hat Advanced Cluster Security 3; advanced-cluster-security/rhacs-main-rhel8 as a component of Red Hat Advanced Cluster Security 3; advanced-cluster-security/rhacs-rhel8-operator as a component of Red Hat Advanced Cluster Security 3; advanced-cluster-security/rhacs-roxctl-rhel8 as a component of Red Hat Advanced Cluster Security 3; aap-cloud-ui-container as a component of Red Hat Ansible Automation Platform 2; automation-controller.src as a component of Red Hat Ansible Automation Platform 2; async.src as a component of Red Hat Fuse 7; odh-dashboard-container as a component of Red Hat OpenShift AI (RHOAI); openshift4/ose-console-rhel9 as a component of Red Hat OpenShift Container Platform 4; rhods/odh-dashboard-rhel8 as a component of Red Hat OpenShift Data Science (RHODS); devspaces/dashboard-rhel8 as a component of Red Hat OpenShift Dev Spaces; devspaces/pluginregistry-rhel8 as a component of Red Hat OpenShift Dev Spaces; devspaces/udi-rhel8 as a component of Red Hat OpenShift Dev Spaces; openshift-gitops-1/argo-rollouts-rhel8 as a component of Red Hat OpenShift GitOps; container-native-virtualization/kubevirt-console-plugin-rhel9 as a component of Red Hat OpenShift Virtualization 4; async.src as a component of Red Hat Process Automation 7
Fixed
advanced-cluster-security/rhacs-central-db-rhel8@sha256:32317f7f89f3da0d2581f17b7d1e958a71d5ce7d237a5b05dc5f1b866acc3557_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-central-db-rhel8@sha256:47f8e6d6f9dae77f8e60689e1936042ae103a5af5d0e2ef49d42e14d26f786e6_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-central-db-rhel8@sha256:c62c8292f9bb8c43bff70b637fa755f445665018026c106bf1d015d90e6ae96b_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-rhel8@sha256:6949f71b182629c28da0e89f40141b2eb3f75cda580795a383527b685d7257fb_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-rhel8@sha256:b1248c4ae062d97a771372709b377fcfefe92adbcea304e61475387e99a7a372_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-rhel8@sha256:b789f63ed29544e44698c35d0ccdcc50d8c400ce5a299a800df59786cfc32f23_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:353df6ff8332de87ad73c5c7c17e7d02105f29a40a0c02e3121a76198b5c7b35_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:3912a19251f037b2c7f081c73a3863a9fb5cf87b7d2f446a62cd96eb418f3f2e_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:c1a79f55a25a6ec83a279025dd85905659f1f70cc8ae806842dc6b383dba3b59_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-main-rhel8@sha256:c137f8bb6e2abed955d768c2017c8927978928c04b7ed84e6b4ba7e17ded9ebe_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-main-rhel8@sha256:c2a5302f3e582fb3040dd955ca24fc1592e50aa65a5cbc88422b7e7f26c73e32_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-main-rhel8@sha256:eaf61da546fe8ebc97a2a65bf01d265fd494c4f5bd0332c9997d9615e37a91ca_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-operator-bundle@sha256:13b48b30a2abf9ef91f5ede1d571f2dea36fa9140f7afa3d31770c776c9a3239_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-operator-bundle@sha256:8bca9a8388de978872eb2834ea7563baacf3a851e1bbaf11acd507d5acce9999_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-operator-bundle@sha256:e154119bfa681132b5e39f03c35699e2247a78782d2c560251e49b40ea054629_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-rhel8-operator@sha256:3c59071106b1f6f749885ca0c6a211c2519b203d1d9a57e326a3cbdf611f5705_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-rhel8-operator@sha256:538c5eeb08643f27e88c7a2c4e20e45c32c1fcce23c4c9f981072800f2aefcac_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-rhel8-operator@sha256:5c3062d2c4135be5091a58b524ddee91a099430a0bbe1a044c646f1ba15c8ad6_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-roxctl-rhel8@sha256:228a15ffc9125b080edb786b8ad66153193e24afbd7567e3615427e640a0686a_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-roxctl-rhel8@sha256:3028aaf6f049917c4e4319f42fd74b240a96e4813445ab4948b0b46c14ae7a07_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-roxctl-rhel8@sha256:729be600c4005de5515bdd5c8e47d16242be0f50de864de84520a21796e18d52_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:4a4cae4f2dd9aafaa7d669cb3bd65d2afa2200e6e78c2c1a42710a6c6f2733d9_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:cc081af30ab994b82df75e4dc476b17c4a8291f51fd0d4719ba57ad2658fb33e_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:e57193441a4efae62c3ef983f23b69aa3c734b0b66d48031d6b6a17fea83647a_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:3835c005d2f275cc8c5d37a762952cb8e8e3e6e24ea081002f41efef7af9bbbc_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:4563fbcd2d00a3df52ee86e9c8ea93a223c0e4bb2c49aaf970199c8496781091_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:69f14260b1736ad2a7d469c4e0d61717876577daf16f4a6d4b58baa97cad5ede_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-rhel8@sha256:75c33e1398027fbd651a07f23e7bc696e276c260dfe9b5505327e25a6421cfc5_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-rhel8@sha256:75ca09f4c3bf9f5a4267a54119030eb333f0fa6ed0aef4c36d90bd2820003db4_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-rhel8@sha256:d0449033954c674b6a1a4b3f1edcf62b113088ad8b900161352862c42763af7c_amd64 as a component of RHACS 4.5 for RHEL 8; and 27 more
Action
If you are using an earlier version of RHACS 4.5, you are advised to upgrade to this patch release 4.5.3.
Workaround
No verified workaround is recorded. If business-safe, reduce exposure to the affected interface and allow only trusted sources until authoritative guidance is available.
04
Evidence and provenance
Published 1 Jul 2024 · Last source change 26 Aug 2024, 14:46 UTC · CWE-1333 · Inefficient Regular Expression Complexity
CVE recordCVE.org · 5.1
CVSS sourceCISA ADP
EPSS source ?The date BlackTree first stored a score for this CVE from the daily FIRST EPSS feed.FIRST · tracked since 2026-08-14
European sourceENISA EUVD · EUVD-2024-37879
Product sourceVendor CSAF · Red Hat Product Security
Remediation sourceVendor CSAF · Red Hat Product Security
CWE sourceCISA ADP
NVD statusNVD not scheduled
Core structured fields are present and their contributing authorities are shown above.
Affected versionsThe structured affected or fixed version information changed.
Before
async.src as a component of Migration Toolkit for Applications 6; mta/mta-ui-rhel9 as a component of Migration Toolkit for Applications 6; multicluster-engine/console-mce-rhel9 as a component of Multicluster Engine for Kubernetes; network-observability/network-observability-console-plugin-rhel9 as a component of Network Observability Operator; workload-availability/node-remediation-console-rhel8 as a component of Node HealthCheck Operator; openshift-pipelines/pipelines-hub-api-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-db-migration-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-ui-rhel8 as a component of OpenShift Pipelines; async.src as a component of OpenShift Serverless; 3scale-amp-system-container as a component of Red Hat 3scale API Management Platform 2; openresty.src as a component of Red Hat 3scale API Management Platform 2; rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes 2; advanced-cluster-security/rhacs-central-db-rhel8 as a component of Red Hat Advanced Cluster Security 3; advanced-cluster-security/rhacs-main-rhel8 as a component of Red Hat Advanced Cluster Security 3; advanced-cluster-security/rhacs-rhel8-operator as a component of Red Hat Advanced Cluster Security 3; advanced-cluster-security/rhacs-roxctl-rhel8 as a component of Red Hat Advanced Cluster Security 3; aap-cloud-ui-container as a component of Red Hat Ansible Automation Platform 2; automation-controller.src as a component of Red Hat Ansible Automation Platform 2; async.src as a component of Red Hat Fuse 7; odh-dashboard-container as a component of Red Hat OpenShift AI (RHOAI); openshift4/ose-console as a component of Red Hat OpenShift Container Platform 4; rhods/odh-dashboard-rhel8 as a component of Red Hat OpenShift Data Science (RHODS); devspaces/dashboard-rhel8 as a component of Red Hat OpenShift Dev Spaces; devspaces/pluginregistry-rhel8 as a component of Red Hat OpenShift Dev Spaces; devspaces/udi-rhel8 as a component of Red Hat OpenShift Dev Spaces; openshift-gitops-1/argo-rollouts-rhel8 as a component of Red Hat OpenShift GitOps; container-native-virtualization/kubevirt-console-plugin-rhel9 as a component of Red Hat OpenShift Virtualization 4; async.src as a component of Red Hat Process Automation 7 · Fixed: advanced-cluster-security/rhacs-central-db-rhel8@sha256:32317f7f89f3da0d2581f17b7d1e958a71d5ce7d237a5b05dc5f1b866acc3557_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-central-db-rhel8@sha256:47f8e6d6f9dae77f8e60689e1936042ae103a5af5d0e2ef49d42e14d26f786e6_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-central-db-rhel8@sha256:c62c8292f9bb8c43bff70b637fa755f445665018026c106bf1d015d90e6ae96b_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-rhel8@sha256:6949f71b182629c28da0e89f40141b2eb3f75cda580795a383527b685d7257fb_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-rhel8@sha256:b1248c4ae062d97a771372709b377fcfefe92adbcea304e61475387e99a7a372_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-rhel8@sha256:b789f63ed29544e44698c35d0ccdcc50d8c400ce5a299a800df59786cfc32f23_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:353df6ff8332de87ad73c5c7c17e7d02105f29a40a0c02e3121a76198b5c7b35_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:3912a19251f037b2c7f081c73a3863a9fb5cf87b7d2f446a62cd96eb418f3f2e_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:c1a79f55a25a6ec83a279025dd85905659f1f70cc8ae806842dc6b383dba3b59_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-main-rhel8@sha256:c137f8bb6e2abed955d768c2017c8927978928c04b7ed84e6b4ba7e17ded9ebe_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-main-rhel8@sha256:c2a5302f3e582fb3040dd955ca24fc1592e50aa65a5cbc88422b7e7f26c73e32_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-main-rhel8@sha256:eaf61da546fe8ebc97a2a65bf01d265fd494c4f5bd0332c9997d9615e37a91ca_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-operator-bundle@sha256:13b48b30a2abf9ef91f5ede1d571f2dea36fa9140f7afa3d31770c776c9a3239_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-operator-bundle@sha256:8bca9a8388de978872eb2834ea7563baacf3a851e1bbaf11acd507d5acce9999_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-operator-bundle@sha256:e154119bfa681132b5e39f03c35699e2247a78782d2c560251e49b40ea054629_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-rhel8-operator@sha256:3c59071106b1f6f749885ca0c6a211c2519b203d1d9a57e326a3cbdf611f5705_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-rhel8-operator@sha256:538c5eeb08643f27e88c7a2c4e20e45c32c1fcce23c4c9f981072800f2aefcac_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-rhel8-operator@sha256:5c3062d2c4135be5091a58b524ddee91a099430a0bbe1a044c646f1ba15c8ad6_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-roxctl-rhel8@sha256:228a15ffc9125b080edb786b8ad66153193e24afbd7567e3615427e640a0686a_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-roxctl-rhel8@sha256:3028aaf6f049917c4e4319f42fd74b240a96e4813445ab4948b0b46c14ae7a07_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-roxctl-rhel8@sha256:729be600c4005de5515bdd5c8e47d16242be0f50de864de84520a21796e18d52_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:4a4cae4f2dd9aafaa7d669cb3bd65d2afa2200e6e78c2c1a42710a6c6f2733d9_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:cc081af30ab994b82df75e4dc476b17c4a8291f51fd0d4719ba57ad2658fb33e_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:e57193441a4efae62c3ef983f23b69aa3c734b0b66d48031d6b6a17fea83647a_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:3835c005d2f275cc8c5d37a762952cb8e8e3e6e24ea081002f41efef7af9bbbc_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:4563fbcd2d00a3df52ee86e9c8ea93a223c0e4bb2c49aaf970199c8496781091_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:69f14260b1736ad2a7d469c4e0d61717876577daf16f4a6d4b58baa97cad5ede_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-rhel8@sha256:75c33e1398027fbd651a07f23e7bc696e276c260dfe9b5505327e25a6421cfc5_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-rhel8@sha256:75ca09f4c3bf9f5a4267a54119030eb333f0fa6ed0aef4c36d90bd2820003db4_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-rhel8@sha256:d0449033954c674b6a1a4b3f1edcf62b113088ad8b900161352862c42763af7c_amd64 as a component of RHACS 4.5 for RHEL 8; and 27 more
After
async.src as a component of Migration Toolkit for Applications 6; mta/mta-ui-rhel9 as a component of Migration Toolkit for Applications 6; multicluster-engine/console-mce-rhel8 as a component of Multicluster Engine for Kubernetes; network-observability/network-observability-console-plugin-rhel9 as a component of Network Observability Operator; workload-availability/node-remediation-console-rhel8 as a component of Node HealthCheck Operator; openshift-pipelines/pipelines-hub-api-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-db-migration-rhel8 as a component of OpenShift Pipelines; openshift-pipelines/pipelines-hub-ui-rhel8 as a component of OpenShift Pipelines; async.src as a component of OpenShift Serverless; 3scale-amp-system-container as a component of Red Hat 3scale API Management Platform 2; openresty.src as a component of Red Hat 3scale API Management Platform 2; rhacm2/console-rhel8 as a component of Red Hat Advanced Cluster Management for Kubernetes 2; advanced-cluster-security/rhacs-central-db-rhel8 as a component of Red Hat Advanced Cluster Security 3; advanced-cluster-security/rhacs-main-rhel8 as a component of Red Hat Advanced Cluster Security 3; advanced-cluster-security/rhacs-rhel8-operator as a component of Red Hat Advanced Cluster Security 3; advanced-cluster-security/rhacs-roxctl-rhel8 as a component of Red Hat Advanced Cluster Security 3; aap-cloud-ui-container as a component of Red Hat Ansible Automation Platform 2; automation-controller.src as a component of Red Hat Ansible Automation Platform 2; async.src as a component of Red Hat Fuse 7; odh-dashboard-container as a component of Red Hat OpenShift AI (RHOAI); openshift4/ose-console-rhel9 as a component of Red Hat OpenShift Container Platform 4; rhods/odh-dashboard-rhel8 as a component of Red Hat OpenShift Data Science (RHODS); devspaces/dashboard-rhel8 as a component of Red Hat OpenShift Dev Spaces; devspaces/pluginregistry-rhel8 as a component of Red Hat OpenShift Dev Spaces; devspaces/udi-rhel8 as a component of Red Hat OpenShift Dev Spaces; openshift-gitops-1/argo-rollouts-rhel8 as a component of Red Hat OpenShift GitOps; container-native-virtualization/kubevirt-console-plugin-rhel9 as a component of Red Hat OpenShift Virtualization 4; async.src as a component of Red Hat Process Automation 7 · Fixed: advanced-cluster-security/rhacs-central-db-rhel8@sha256:32317f7f89f3da0d2581f17b7d1e958a71d5ce7d237a5b05dc5f1b866acc3557_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-central-db-rhel8@sha256:47f8e6d6f9dae77f8e60689e1936042ae103a5af5d0e2ef49d42e14d26f786e6_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-central-db-rhel8@sha256:c62c8292f9bb8c43bff70b637fa755f445665018026c106bf1d015d90e6ae96b_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-rhel8@sha256:6949f71b182629c28da0e89f40141b2eb3f75cda580795a383527b685d7257fb_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-rhel8@sha256:b1248c4ae062d97a771372709b377fcfefe92adbcea304e61475387e99a7a372_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-rhel8@sha256:b789f63ed29544e44698c35d0ccdcc50d8c400ce5a299a800df59786cfc32f23_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:353df6ff8332de87ad73c5c7c17e7d02105f29a40a0c02e3121a76198b5c7b35_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:3912a19251f037b2c7f081c73a3863a9fb5cf87b7d2f446a62cd96eb418f3f2e_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-collector-slim-rhel8@sha256:c1a79f55a25a6ec83a279025dd85905659f1f70cc8ae806842dc6b383dba3b59_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-main-rhel8@sha256:c137f8bb6e2abed955d768c2017c8927978928c04b7ed84e6b4ba7e17ded9ebe_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-main-rhel8@sha256:c2a5302f3e582fb3040dd955ca24fc1592e50aa65a5cbc88422b7e7f26c73e32_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-main-rhel8@sha256:eaf61da546fe8ebc97a2a65bf01d265fd494c4f5bd0332c9997d9615e37a91ca_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-operator-bundle@sha256:13b48b30a2abf9ef91f5ede1d571f2dea36fa9140f7afa3d31770c776c9a3239_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-operator-bundle@sha256:8bca9a8388de978872eb2834ea7563baacf3a851e1bbaf11acd507d5acce9999_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-operator-bundle@sha256:e154119bfa681132b5e39f03c35699e2247a78782d2c560251e49b40ea054629_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-rhel8-operator@sha256:3c59071106b1f6f749885ca0c6a211c2519b203d1d9a57e326a3cbdf611f5705_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-rhel8-operator@sha256:538c5eeb08643f27e88c7a2c4e20e45c32c1fcce23c4c9f981072800f2aefcac_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-rhel8-operator@sha256:5c3062d2c4135be5091a58b524ddee91a099430a0bbe1a044c646f1ba15c8ad6_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-roxctl-rhel8@sha256:228a15ffc9125b080edb786b8ad66153193e24afbd7567e3615427e640a0686a_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-roxctl-rhel8@sha256:3028aaf6f049917c4e4319f42fd74b240a96e4813445ab4948b0b46c14ae7a07_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-roxctl-rhel8@sha256:729be600c4005de5515bdd5c8e47d16242be0f50de864de84520a21796e18d52_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:4a4cae4f2dd9aafaa7d669cb3bd65d2afa2200e6e78c2c1a42710a6c6f2733d9_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:cc081af30ab994b82df75e4dc476b17c4a8291f51fd0d4719ba57ad2658fb33e_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-rhel8@sha256:e57193441a4efae62c3ef983f23b69aa3c734b0b66d48031d6b6a17fea83647a_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:3835c005d2f275cc8c5d37a762952cb8e8e3e6e24ea081002f41efef7af9bbbc_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:4563fbcd2d00a3df52ee86e9c8ea93a223c0e4bb2c49aaf970199c8496781091_amd64 as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-db-slim-rhel8@sha256:69f14260b1736ad2a7d469c4e0d61717876577daf16f4a6d4b58baa97cad5ede_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-rhel8@sha256:75c33e1398027fbd651a07f23e7bc696e276c260dfe9b5505327e25a6421cfc5_s390x as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-rhel8@sha256:75ca09f4c3bf9f5a4267a54119030eb333f0fa6ed0aef4c36d90bd2820003db4_ppc64le as a component of RHACS 4.5 for RHEL 8; advanced-cluster-security/rhacs-scanner-rhel8@sha256:d0449033954c674b6a1a4b3f1edcf62b113088ad8b900161352862c42763af7c_amd64 as a component of RHACS 4.5 for RHEL 8; and 27 more
Technical terms and abbreviations used in this report
CVE
Common Vulnerabilities and Exposures: the public identifier for one disclosed vulnerability.
CVSS
Common Vulnerability Scoring System: a technical severity framework; it is not patching priority by itself.
EPSS
Exploit Prediction Scoring System: FIRST's estimate of the probability that exploitation activity will be observed in the next 30 days; it is a forecast, not confirmation.
CWE
Common Weakness Enumeration: the standard category describing the underlying software or hardware weakness.
CNA
CVE Numbering Authority: an organisation authorised to assign and publish CVE records.
CISA ADP
Cybersecurity and Infrastructure Security Agency Authorized Data Publisher: structured enrichment added to a CVE record.
NVD
National Vulnerability Database: NIST's enrichment service for CVE records.
CERT / CSIRT
A computer security incident response team that publishes warnings or coordinates incident response.
PoC
Proof of concept: public material that demonstrates or helps reproduce exploitation.
CSAF
Common Security Advisory Framework: a machine-readable format for security advisories.
LoTL
Living off the land: abuse of legitimate tools or system functions during an attack.
CVE-2024-39249: Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function | BlackTree
