(RHSA-2024:3920) Important: Migration Toolkit for Runtimes security, bug fix and enhancement update

2024-06-1311:01:17

access.redhat.com

migration toolkit

runtimes

security

bug fix

enhancement

update

axios

follow-redirects

commons-configuration2

webpack-dev-middleware

cvss score

unix

cve page.

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

AI Score

7.1

Confidence

Low

JSON

Migration Toolkit for Runtimes 1.2.6 ZIP artifacts

Security Fix(es):

axios: exposure of confidential data stored in cookies (CVE-2023-45857)
follow-redirects: Possible credential leak (CVE-2024-28849)
commons-configuration2: various flaws (CVE-2024-29131)
commons-configuration2: various flaws (CVE-2024-29133)
webpack-dev-middleware: lack of URL validation may lead to file leak (CVE-2024-29180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.