RHSA-2024:6487 - Security Advisory

Topic

Updated Release packages that fix several bugs and add various enhancements are now available.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Description

Migration Toolkit for Virtualization 2.6.6 Images

Security Fix(es):

• Empty bearer token may perform authentication (CVE-2024-8509)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Migration Toolkit for Virtualization 2 x86_64
• Migration Toolkit for Virtualization 1 x86_64

Fixes

• BZ - 2310406 - CVE-2024-8509 Migration Toolkit for Virtualization: forklift-controller: Empty bearer token may perform authentication
• MTV-1353 - runtime error: invalid memory address or nil pointer dereference
• MTV-1354 - All Plan and Migration pods scheduled to same node, crashes node

CVEs

• CVE-2024-6923
• CVE-2024-8509
• CVE-2024-37370
• CVE-2024-37371

References

• https://access.redhat.com/security/updates/classification/#important