Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an index or size in the range 2 ** 30 to 2 ** 31 in setListBounds in src/List.js, causing an empty List to enter an uncatchable infinite loop, a populated List to allocate without bound until process abort, or setSize to silently wrap large values. This issue is fixed in versions 4.3.9 and 5.1.8.
> This issue is fixed in versions 4.3.9 and 5.1.8. This vulnerability is resolved by the release version 17 of subscription-manager-cockpit. It includes immutable version 5.1.9. Currently, the version 17 of sub-man-c is available in fedora-rawhide and for fedora-44 and fedora-43 it is in testing. Rawhide: https://koji.fedoraproject.org/koji/buildinfo?buildID=3071183 F-44: https://koji.fedoraproject.org/koji/buildinfo?buildID=3071182 F-43: https://koji.fedoraproject.org/koji/buildinfo?buildID=3071190
This is not a runtime dependency of subscription-manager-cockpit, but a build dependency pulled in via esbuild-plugin-sass. The worst it could do is make the build hang so we determine that this CVE does not affect the Fedora package. [root@fedora-44-127-0-0-2-2201 ~]# rpm -q --provides subscription-manager-cockpit application() application(subscription-manager-cockpit.desktop) bundled(npm(@patternfly/react-core)) = 6.6.0 bundled(npm(@patternfly/react-icons)) = 6.6.0 bundled(npm(@patternfly/react-styles)) = 6.6.0 bundled(npm(@patternfly/react-table)) = 6.6.0 bundled(npm(@patternfly/react-tokens)) = 6.6.0 bundled(npm(focus-trap)) = 7.6.6 bundled(npm(lodash)) = 4.18.1 bundled(npm(prop-types)) = 15.8.1 bundled(npm(react)) = 18.3.1 bundled(npm(react-dom)) = 18.3.1 bundled(npm(scheduler)) = 0.23.2 bundled(npm(tabbable)) = 6.5.0 bundled(npm(tslib)) = 2.8.1