Bug 2319884 (CVE-2024-21536)
| Summary: | CVE-2024-21536 http-proxy-middleware: Denial of Service | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aazores, abarbaro, adudiak, adupliak, akostadi, alcohan, amasferr, amctagga, anjoseph, anpicker, bdettelb, brking, caswilli, cbartlet, cdaley, chazlett, cmah, cmiranda, danken, dbosanac, dhanak, dkuc, dmayorov, doconnor, dsimansk, dymurray, eaguilar, ebaron, ecerquei, eric.wittmann, fdeutsch, fjansen, gkamathe, gmalinko, gparvin, gtanzill, haoli, hasun, hkataria, ibek, ibolton, jajackso, janstey, jcammara, jcantril, jchui, jforrest, jfula, jhe, jkoehler, jlledo, jmatthew, jmitchel, jmontleo, jneedle, jolong, jowilson, jprabhak, jreimann, jrokos, jwendell, jwong, kaycoth, kegrant, kingland, koliveir, kshier, ktsao, kverlaen, lchilton, lphiri, mabashia, matzew, mdessi, mjaros, mkudlej, mmakovy, mnovotny, mrizzi, mwringe, nboldt, nipatil, njean, nyancey, omaciel, ometelka, oramraz, owatkins, pahickey, pantinor, parichar, pbraun, pcattana, pcongius, pdelbell, pgaikwad, phoracek, pierdipi, pjindal, psrna, ptisnovs, rcernich, rguimara, rhaigner, rhuss, rjohnson, rkubis, rojacob, rstepani, rtaniwa, saroy, sdawley, sfeifer, sfroberg, shvarugh, simaishi, slucidi, smcdonal, smullick, sseago, stcannon, stirabos, syedriko, tasato, teagle, tfister, thason, thavo, tjochec, tkral, twalsh, wtam, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in the http-proxy-middleware package. Affected versions of this package are vulnerable to denial of service (DoS) due to an UnhandledPromiseRejection error thrown by micromatch. This flaw allows an attacker to kill the Node.js process and crash the server by requesting certain paths.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2320111, 2320113, 2320115, 2320116, 2320118, 2320119, 2320120, 2320121, 2320122 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2024-10-19 06:01:01 UTC
This issue has been addressed in the following products: Red Hat OpenShift Service Mesh 2.6 for RHEL 8 Red Hat OpenShift Service Mesh 2.6 for RHEL 9 Via RHSA-2024:9627 https://access.redhat.com/errata/RHSA-2024:9627 This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.5 Via RHSA-2025:3928 https://access.redhat.com/errata/RHSA-2025:3928 This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.6 Via RHSA-2025:3929 https://access.redhat.com/errata/RHSA-2025:3929 This issue has been addressed in the following products: Red Hat Advanced Cluster Security 4.7 Via RHSA-2025:3930 https://access.redhat.com/errata/RHSA-2025:3930 This issue has been addressed in the following products: RHODF-4.18-RHEL-9 Via RHSA-2025:4511 https://access.redhat.com/errata/RHSA-2025:4511 This issue has been addressed in the following products: RHODF-4.16-RHEL-9 Via RHSA-2025:8479 https://access.redhat.com/errata/RHSA-2025:8479 This issue has been addressed in the following products: Red Hat Migration Toolkit for Containers 1.8 Via RHSA-2025:8510 https://access.redhat.com/errata/RHSA-2025:8510 This issue has been addressed in the following products: RHODF-4.15-RHEL-9 Via RHSA-2025:8544 https://access.redhat.com/errata/RHSA-2025:8544 This issue has been addressed in the following products: RHODF-4.14-RHEL-9 Via RHSA-2025:8551 https://access.redhat.com/errata/RHSA-2025:8551 |