Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 491
Alerts This Week
Warning Icon 1 491

RedHat: RHSA-2023-0934-01 Important: Migration Toolkit Security Update

red hat
Calendar Grey February 28, 2023
Scroller Redhat
The latest update for Red Hat's Migration Toolkit tackles crucial vulnerabilities and resolves various bugs to improve overall application safety.
Migration Toolkit for Applications 6.0.1 release Red Hat Product Security has rated this update as having a security impact of Important

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Summary

Migration Toolkit for Applications 6.0.1 Images
Security Fix(es) from Bugzilla:
* loader-utils: prototype pollution in function parseQuery in parseQuery.js (CVE-2022-37601)
* Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing (CVE-2022-42920)
* gin: Unsanitized input in the default logger in github.com/gin-gonic/gin (CVE-2020-36567)
* glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* express: "qs" prototype poisoning causes the hang of the node process (CVE-2022-24999)
* loader-utils:Regular expression denial of service (CVE-2022-37603)
* golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory denial of service bug fix security fix important redhat migration toolkit

References

https://access.redhat.com/security/cve/CVE-2020-36567 https://access.redhat.com/security/cve/CVE-2021-35065 https://access.redhat.com/security/cve/CVE-2021-46848 https://access.redhat.com/security/cve/CVE-2022-1304 https://access.redhat.com/security/cve/CVE-2022-2056 https://access.redhat.com/security/cve/CVE-2022-2057 https://access.redhat.com/security/cve/CVE-2022-2058 https://access.redhat.com/security/cve/CVE-2022-2519 https://access.redhat.com/security/cve/CVE-2022-2520 https://access.redhat.com/security/cve/CVE-2022-2521 https://access.redhat.com/security/cve/CVE-2022-2601 https://access.redhat.com/security/cve/CVE-2022-2867 https://access.redhat.com/security/cve/CVE-2022-2868 https://access.redhat.com/security/cve/CVE-2022-2869 https://access.redhat.com/security/cve/CVE-2022-2953 https://access.redhat.com/security/cve/CVE-2022-3775 https://access.redhat.com/security/cve/CVE-2022-3787 https://access.redhat.com/security/cve/CVE-2022-22624 https://access.redhat.com/security/cve/CVE-2022-22628 https://access.redhat.com/security/cve/CVE-2022-22629 https://access.redhat.com/security/cve/CVE-2022-22662 https://access.redhat.com/security/cve/CVE-2022-23521 https://access.redhat.com/security/cve/CVE-2022-24999 https://access.redhat.com/security/cve/CVE-2022-25308 Read the Full Advisory

Package List


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2023:0934-01
Product: MTA
Advisory URL: https://access.redhat.com/errata/RHSA-2023:0934
Issue date: 2023-02-28

Topic

Migration Toolkit for Applications 6.0.1 releaseRed Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory denial of service bug fix security fix important redhat migration toolkit

Relevant Releases Architectures

Bugs Fixed

2134876 - CVE-2022-37601 loader-utils: prototype pollution in function parseQuery in parseQuery.js

2140597 - CVE-2022-37603 loader-utils:Regular expression denial of service

2142707 - CVE-2022-42920 Apache-Commons-BCEL: arbitrary bytecode produced via out-of-bounds writing

2150323 - CVE-2022-24999 express: "qs" prototype poisoning causes the hang of the node process

2156263 - CVE-2022-46175 json5: Prototype Pollution in JSON5 via Parse Method

2156324 - CVE-2021-35065 glob-parent: Regular Expression Denial of Service

2156683 - CVE-2020-36567 gin: Unsanitized input in the default logger in github.com/gin-gonic/gin

2161274 - CVE-2022-41717 golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests

5. JIRA issues fixed (https://redhat.atlassian.net/jira/projects):

MTA-103 - MTA 6.0.1 Installation failed with CrashLoop Error for UI Pod

MTA-106 - Implement ability for windup addon image pull policy to be configurable

MTA-122 - MTA is upgrading automatically ignoring 'Manual' setting

MTA-123 - MTA Becomes unusable when running bulk binary analysis

MTA-127 - After upgrading MTA operator from 6.0.0 to 6.0.1 and running analysis , task pods starts failing

MTA-131 - Analysis stops working after MTA upgrade from 6.0.0 to 6.0.1

MTA-36 - Can't disable a proxy if it has an invalid configuration

MTA-44 - Make RWX volumes optional.

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.