RHSA-2024:3316 - Security Advisory

Topic

Migration Toolkit for Applications 7.0.3 release

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Description

Migration Toolkit for Applications 7.0.3 Images

Security Fix(es) from Bugzilla:

• golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288)
• webpack-dev-middleware: lack of URL validation may lead to file leak (CVE-2024-29180)
• axios: exposure of confidential data stored in cookies (CVE-2023-45857)
• css-tools: Improper Input Validation causes Denial of Service via Regular Expression (CVE-2023-26364)
• go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2 (CVE-2023-45286)
• golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)
• golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)
• css-tools: regular expression denial of service (ReDoS) when parsing CSS (CVE-2023-48631)
• follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() (CVE-2023-26159)
• golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
• follow-redirects: Possible credential leak (CVE-2024-28849)

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Migration Toolkit for Applications 1 x86_64

Fixes

• BZ - 2248979 - CVE-2023-45857 axios: exposure of confidential data stored in cookies
• BZ - 2250364 - CVE-2023-26364 css-tools: Improper Input Validation causes Denial of Service via Regular Expression
• BZ - 2252012 - CVE-2023-45286 go-resty: HTTP request body disclosure in github.com/go-resty/resty/v2
• BZ - 2253193 - CVE-2023-45287 golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges.
• BZ - 2253330 - CVE-2023-39326 golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests
• BZ - 2254559 - CVE-2023-48631 css-tools: regular expression denial of service (ReDoS) when parsing CSS
• BZ - 2256413 - CVE-2023-26159 follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse()
• BZ - 2268046 - CVE-2024-24786 golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON
• BZ - 2268273 - CVE-2023-45288 golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS
• BZ - 2269576 - CVE-2024-28849 follow-redirects: Possible credential leak
• BZ - 2270863 - CVE-2024-29180 webpack-dev-middleware: lack of URL validation may lead to file leak
• MTA-1578 - Admin drop-down can be enhanced
• MTA-1959 - [Analysis issues] Unclear display for the 6th and higher incidents in a file
• MTA-1961 - [Analysis issues] Issue details side drawer is not fully displayed by default
• MTA-1970 - It is not clear that the Effort column in the "Affected applications page" is the total effort
• MTA-1997 - [Controls][UI] Pages layout shifts in Controls tab
• MTA-2003 - [Custom rules in analysis] Number of rules is 0 when manually uploading yaml file
• MTA-2117 - Apps that inherit assessment occasionally don't get displayed on Reports tab
• MTA-2186 - Tag filtering doesn't work if searching for empty tag type
• MTA-2224 - [UI] Pagination leaves empty page when removing last element
• MTA-2243 - [Analyzer] Affected file empty using JWS6 target
• MTA-2287 - Tag sources should start with upper case letters
• MTA-2308 - [Assessment] UI should show 'Unassessed' instead of 'Unknown' for unassessed applications
• MTA-2314 - MTA CLI limitations with podman on windows
• MTA-2341 - [Analyzer] Placeholder for`beans.xml` can be correctly interpolated.
• MTA-2380 - Error message when editing an application tag
• MTA-2400 - Selection of already selected tags should be disallowed for archetypes
• MTA-2409 - With two required questionnaires app Assessment status should be 'In progress' after one questionnaire is taken
• MTA-2410 - App Assesstment status should show 'In progress' when only one archetype has been assessed
• MTA-2426 - [Jira instance] Unable to turn on "Enable insecure communication" switch
• MTA-2427 - Failed to connect to Jira server using basic authentication: username & password
• MTA-2451 - Application Inventory page doesn't get updated after application import
• MTA-2452 - [Kantra CLI] Running test is successfull with many errors in the log
• MTA-2495 - Repeated Assessment Override Notification Appears After Completion
• MTA-2503 - Application assessment status doesn't get updated on its own after assessment is discarded
• MTA-2505 - [Assessment] assessing an application and then disabling the questionnaire shows status 'In-Progress'
• MTA-2512 - Retaking an assessment should retain the previous assessment data
• MTA-2513 - [Analysis][DC] Analysis are failing on DC clusters with" Error: exit status 128 "
• MTA-2518 - [CLI] Failing analysis on MAC
• MTA-2550 - [Analysis] Some analyses fail with UNIQUE constraint failed error on Tags
• MTA-2560 - [UI] Missing "Use multi select filter for application names" from All Issues Page
• MTA-2563 - [Eclipse] [IDE] unable to run analysis on eclipse - mta 7.0.3
• MTA-2616 - 'Retake' displayed instead of 'Take' after deleting Archetype assessment from Assessment Actions page
• MTA-2652 - The Risk filter in the Reports Tab filters by value instead of by label when typing in it
• MTA-2654 - [CLI] Some tests are failing with error about output.yaml
• MTA-2661 - Binary analysis fails for a JAR file that has no external dependencies
• MTA-2681 - Column name renamed "Tag category" to "Name" on Tags page
• MTA-2781 - [Kantra CLI] Tool tried to pull image from a wrong place making analysis to fail

CVEs

• CVE-2021-43618
• CVE-2022-48554
• CVE-2022-48624
• CVE-2023-2975
• CVE-2023-3446
• CVE-2023-3817
• CVE-2023-4408
• CVE-2023-5678
• CVE-2023-6129
• CVE-2023-6237
• CVE-2023-6240
• CVE-2023-7008
• CVE-2023-25193
• CVE-2023-26159
• CVE-2023-26364
• CVE-2023-28322
• CVE-2023-38469
• CVE-2023-38470
• CVE-2023-38471
• CVE-2023-38472
• CVE-2023-38473
• CVE-2023-38546
• CVE-2023-39326
• CVE-2023-43785
• CVE-2023-43786
• CVE-2023-43787
• CVE-2023-45286
• CVE-2023-45287
• CVE-2023-45288
• CVE-2023-45289
• CVE-2023-45290
• CVE-2023-45857
• CVE-2023-46218
• CVE-2023-47038
• CVE-2023-48631
• CVE-2023-50387
• CVE-2023-50868
• CVE-2023-52425
• CVE-2024-0727
• CVE-2024-1394
• CVE-2024-1488
• CVE-2024-2961
• CVE-2024-21011
• CVE-2024-21012
• CVE-2024-21068
• CVE-2024-21094
• CVE-2024-22365
• CVE-2024-24783
• CVE-2024-24784
• CVE-2024-24785
• CVE-2024-24786
• CVE-2024-25062
• CVE-2024-25742
• CVE-2024-25743
• CVE-2024-28834
• CVE-2024-28835
• CVE-2024-28849
• CVE-2024-29180

References

• https://access.redhat.com/security/updates/classification/#important