csaf_redhat - rhsa-2025:3807

rhsa-2025:3807

Vulnerability from csaf_redhat

Published

2025-04-10 14:20

Modified

2025-08-03 09:27

Summary

Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release

Notes

Topic

The 1.1.2 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details see [product documentation](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1).

Details

The RHTAS Operator can be used with OpenShift Container Platform 4.14, 4.15, 4.16, 4.17, and 4.18

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The 1.1.2 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details see [product documentation](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1).",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The RHTAS Operator can be used with OpenShift Container Platform 4.14, 4.15, 4.16, 4.17, and 4.18",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2025:3807",
        "url": "https://access.redhat.com/errata/RHSA-2025:3807"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-51479",
        "url": "https://access.redhat.com/security/cve/CVE-2024-51479"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-56332",
        "url": "https://access.redhat.com/security/cve/CVE-2024-56332"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_3807.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHTAS 1.1.2 - Red Hat Trusted Artifact Signer Release",
    "tracking": {
      "current_release_date": "2025-08-03T09:27:25+00:00",
      "generator": {
        "date": "2025-08-03T09:27:25+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.6"
        }
      },
      "id": "RHSA-2025:3807",
      "initial_release_date": "2025-04-10T14:20:32+00:00",
      "revision_history": [
        {
          "date": "2025-04-10T14:20:32+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-04-10T14:20:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-08-03T09:27:25+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Trusted Artifact Signer 1.1",
                "product": {
                  "name": "Red Hat Trusted Artifact Signer 1.1",
                  "product_id": "Red Hat Trusted Artifact Signer 1.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:trusted_artifact_signer:1.1::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Trusted Artifact Signer"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64",
                "product": {
                  "name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64",
                  "product_id": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rekor-search-ui-rhel9@sha256%3A571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1.1.2-1744101482"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64 as a component of Red Hat Trusted Artifact Signer 1.1",
          "product_id": "Red Hat Trusted Artifact Signer 1.1:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64"
        },
        "product_reference": "registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64",
        "relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-51479",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2024-12-17T19:00:43.117301+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2332884"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Next.js framework. An incorrectly sanitized query parameter can cause an invalid routing condition, resulting in the wrong route being served to users and allowing authorization bypass when an application is performing path-based middleware authorization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "next.js: next: authorization bypass in Next.js",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects self-hosted applications with a missing i18n configuration performing path-based middleware authorization. Applications hosted on Vercel are not vulnerable to this vulnerability.\n\nAdditionally, only pages under the root directory of the application are vulnerable to this issue, for example:\n\nhttps://example.com/: not vulnerable\n\nhttps://example.com/foo: vulnerable\n\nhttps://example.com/foo/bar: not vulnerable",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.1:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-51479"
        },
        {
          "category": "external",
          "summary": "RHBZ#2332884",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2332884"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-51479",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-51479"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-51479",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51479"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/releases/tag/v14.2.15",
          "url": "https://github.com/vercel/next.js/releases/tag/v14.2.15"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-7gfc-8cq8-jh5f"
        }
      ],
      "release_date": "2024-12-17T18:13:02.806000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-04-10T14:20:32+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the [Sigstore project](https://sigstore.dev/). Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain. For details on using the operator, refer to [product documentation](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1). You can find the release notes for this version of Red Hat Trusted Artifact Signer [here](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index).",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.1:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:3807"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.1:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.1:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "next.js: next: authorization bypass in Next.js"
    },
    {
      "cve": "CVE-2024-56332",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-01-03T21:00:40.973999+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2335479"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Next.js package. A denial of service (DoS) attack allows attackers to construct requests that leave requests to Server Actions hanging until the hosting provider cancels the function execution. The Next.js server is idle during that time and only keeps the connection open. The CPU and memory footprint are low during that time. This is the same issue as if the incoming HTTP request has an invalid Content-Length header or never closes. This vulnerability is novel if the host has no other mitigations for those.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "next.js: Next.js Vulnerable to Denial of Service (DoS) with Server Actions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability affects only Next.js deployments using Server Actions.\n\nDeployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Trusted Artifact Signer 1.1:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-56332"
        },
        {
          "category": "external",
          "summary": "RHBZ#2335479",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2335479"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-56332",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-56332"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-56332",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56332"
        },
        {
          "category": "external",
          "summary": "https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9",
          "url": "https://github.com/vercel/next.js/security/advisories/GHSA-7m27-7ghc-44w9"
        }
      ],
      "release_date": "2025-01-03T20:19:11.525000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-04-10T14:20:32+00:00",
          "details": "Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the [Sigstore project](https://sigstore.dev/). Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization\u0027s software supply chain. For details on using the operator, refer to [product documentation](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1). You can find the release notes for this version of Red Hat Trusted Artifact Signer [here](https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.1/html-single/release_notes/index).",
          "product_ids": [
            "Red Hat Trusted Artifact Signer 1.1:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2025:3807"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Trusted Artifact Signer 1.1:registry.redhat.io/rhtas/rekor-search-ui-rhel9@sha256:571c48ecb2658ce70199c06dc483ea48a16e032a764a6830388ad845f508d981_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "next.js: Next.js Vulnerable to Denial of Service (DoS) with Server Actions"
    }
  ]
}

CVE-2024-51479 (GCVE-0-2024-51479)

Vulnerability from cvelistv5

Published

2024-12-17 18:13

Modified

2024-12-17 20:36

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-285 - Improper Authorization

Summary

Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed for pages directly under the application's root directory. For example: * [Not affected] `https://example.com/` * [Affected] `https://example.com/foo` * [Not affected] `https://example.com/foo/bar`. This issue is patched in Next.js `14.2.15` and later. If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version. There are no official workarounds for this vulnerability.

References

►

URL

	Vendor	Product	Version
	vercel	next.js	Version: >= 9.5.5, < 14.2.15

CVE-2024-56332 (GCVE-0-2024-56332)

Vulnerability from cvelistv5

Published

2025-01-03 20:19

Modified

2025-01-03 20:51

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and 15.1.2, Next.js is vulnerable to a Denial of Service (DoS) attack that allows attackers to construct requests that leaves requests to Server Actions hanging until the hosting provider cancels the function execution. This vulnerability can also be used as a Denial of Wallet (DoW) attack when deployed in providers billing by response times. (Note: Next.js server is idle during that time and only keeps the connection open. CPU and memory footprint are low during that time.). Deployments without any protection against long running Server Action invocations are especially vulnerable. Hosting providers like Vercel or Netlify set a default maximum duration on function execution to reduce the risk of excessive billing. This is the same issue as if the incoming HTTP request has an invalid `Content-Length` header or never closes. If the host has no other mitigations to those then this vulnerability is novel. This vulnerability affects only Next.js deployments using Server Actions. The issue was resolved in Next.js 13.5.8, 14.2.21, and 15.1.2. We recommend that users upgrade to a safe version. There are no official workarounds.

References

►

URL

	Vendor	Product	Version
	vercel	next.js	Version: >= 13.0.0, < 13.5.8 Version: >= 14.0.0, < 14.2.21 Version: >= 15.0.0, < 15.1.2

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

rhsa-2025:3807

Vulnerability from csaf_redhat

CVE-2024-51479 (GCVE-0-2024-51479)

Vulnerability from cvelistv5

CVE-2024-56332 (GCVE-0-2024-56332)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature