RHSA-2024:4893 — Security Advisory

An update for rhc-worker-script is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The rhc-worker-script package provides a worker for the Remote Host Configuration (rhc) for the purpose of executing an interpreted programming language script on hosts managed by Red Hat Insights.

Security Fix(es):

• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)

• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.