Skip to content
OpenAdvisories
Critical RHSA-2024:4893 4 CVEs

Red Hat Security Advisory: rhc-worker-script security update

Published Oct 2, 2024 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 7 ELS rhel_els:7 rhc-worker-script 0:0.9-5.el7_9

Vulnerabilities 4

  • Critical 9.8
    CVE-2024-24790

    Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip

    The various Is methods (IsPrivate, IsLoopback, etc) did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms.

    Go standard library net/netip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.5
    CVE-2023-45290

    Memory exhaustion in multipart form parsing in net/textproto and net/http

    When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

    Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.9
    CVE-2024-24783

    Verify panics on certificates with an unknown public key algorithm in crypto/x509

    Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.4
    CVE-2024-24785

    Errors returned from JSON marshaling may break template escaping in html/template

    If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

    Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268017
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268019
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268022
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2292787
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4893.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-45290
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-45290
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-45290
  • article
    http://www.openwall.com/lists/oss-security/2024/03/08/4
  • article
    https://go.dev/cl/569341
  • article
    https://go.dev/issue/65383
  • article
    https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
  • advisory
    https://pkg.go.dev/vuln/GO-2024-2599
  • article
    https://security.netapp.com/advisory/ntap-20240329-0004
  • report
    https://access.redhat.com/security/cve/CVE-2024-24783
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-24783
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-24783
  • advisory
    https://github.com/advisories/GHSA-3q2c-pvp5-3cqp
  • article
    https://go.dev/cl/569339
  • article
    https://go.dev/issue/65390
  • advisory
    https://pkg.go.dev/vuln/GO-2024-2598
  • article
    https://security.netapp.com/advisory/ntap-20240329-0005
  • report
    https://access.redhat.com/security/cve/CVE-2024-24785
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-24785
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-24785
  • article
    https://go.dev/cl/564196
  • article
    https://go.dev/issue/65697
  • article
    https://vuln.go.dev/ID/GO-2024-2610.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-24790
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-24790
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-24790